Internet Explorer Cross-domain Information Disclosure Vulnerability

Successful exploitation allows a remote attacker to disclose information that should be isolated by the browser same-origin and zone boundary protections. Specifically, an attacker-controlled website can read content from another domain or from a different Internet Explorer security zone, potentially exposing sensitive web content or data accessible in the victim's browser session.

The provided content does not list a specific workaround for CVE-2015-0070. Exposure is reduced on affected Windows Server platforms by Internet Explorer Enhanced Security Configuration, which limits access to specially crafted web content. General risk reduction also depends on preventing users from visiting attacker-controlled webpages.

Apply Microsoft Security Update 3034682 for affected Internet Explorer versions. The provided content states that for Internet Explorer 9, 10, and 11, both update 3021952 and update 3034196 are required for full protection. Microsoft also noted installation-order requirements for manual deployment: update 3021952 should be installed before 3034196. On some platforms, installing 3021952 also installs updates 3023607 and 3036197 automatically.