Advisory Details

This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of registry links. An attacker running code in a low-integrity Internet Explorer process can set a registry link that will be followed by the medium-integrity broker process, which will then reduce the security of the target registry key in such a way that it can be modified by low-integrity Internet Explorer processes. These registry keys can be used to execute medium-integrity processes from low-integrity Internet Explorer processes.

• 2015-02-12 - Vulnerability reported to vendor
• 2015-08-11 - Coordinated public release of advisory