CVE-2011-0663

EPSS 25.49%
Published 13.04.2011 18:55:01
Last modified 11.04.2025 00:51:21
Source secure@microsoft.com
Teams watchlist Login
Open Login

Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a crafted web page, aka "Scripting Memory Reallocation Vulnerability."

Affected products Warnungen 0 Metrics 3 CWE 1 References 11

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ Jscript Version5.6

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ Vbscript Version5.6

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ Jscript Version5.7

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Version- Updatesp2 Editionitanium
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ Vbscript Version5.7

Microsoft ≫ Jscript Version5.8

   Microsoft ≫ Windows 2003 Server Updatesp2
   Microsoft ≫ Windows 7 Version-
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx64
   Microsoft ≫ Windows 7 Version- Updatesp1 Editionx86
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx32
   Microsoft ≫ Windows Server 2008 Updatesp2 Editionx64
   Microsoft ≫ Windows Server 2008 Versionr2 Editionitanium
   Microsoft ≫ Windows Server 2008 Versionr2 Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Vista Updatesp2
   Microsoft ≫ Windows Xp Updatesp3
   Microsoft ≫ Windows Xp Version- Updatesp2 Editionx64

Microsoft ≫ Vbscript Version5.8

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	25.49%	0.961

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

http://www.us-cert.gov/cas/techalerts/TA11-102A.html

US Government Resource

http://osvdb.org/71774

http://secunia.com/advisories/44162

http://www.securityfocus.com/bid/47249

http://www.securitytracker.com/id?1025333

http://www.vupen.com/english/advisories/2011/0949

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-031

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12673

https://nvd.nist.gov/vuln/detail/CVE-2011-0663

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-0663

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-0663

EUVD