CVE-2012-4792
- EPSS 91.48%
- Veröffentlicht 30.12.2012 18:55:01
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle secure@microsoft.com
- Teams Watchlist Login
- Unerledigt Login
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
Microsoft ≫ Windows Xp Updatesp3
Microsoft ≫ Windows Xp Version- Updatesp2 HwPlatformx64
Microsoft ≫ Windows Server 2008 Updatesp2 HwPlatformx64
Microsoft ≫ Windows Server 2008 Updatesp2 HwPlatformx86
Microsoft ≫ Windows Server 2008 Version- Updatesp2 HwPlatformitanium
Microsoft ≫ Windows Vista Updatesp2
Microsoft ≫ Windows Vista Version- Updatesp2
Microsoft ≫ Windows Xp Updatesp3
Microsoft ≫ Windows Xp Version- Updatesp2 HwPlatformx64
Microsoft ≫ Windows 7 Version- Updatesp1 HwPlatformx64
Microsoft ≫ Windows 7 Version- Updatesp1 HwPlatformx86
Microsoft ≫ Windows Server 2003 Updatesp2
Microsoft ≫ Windows Server 2008 Updater2 HwPlatformitanium
Microsoft ≫ Windows Server 2008 Updater2 HwPlatformx64
Microsoft ≫ Windows Server 2008 Version- Updatesp2 HwPlatformx64
Microsoft ≫ Windows Server 2008 Version- Updatesp2 HwPlatformx86
Microsoft ≫ Windows Vista Updatesp2
Microsoft ≫ Windows Vista Version- Updatesp2
Microsoft ≫ Windows Xp Updatesp3
Microsoft ≫ Windows Xp Version- Updatesp2 SwEditionprofessional HwPlatformx64
23.07.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog
Microsoft Internet Explorer Use-After-Free Vulnerability
SchwachstelleMicrosoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.
BeschreibungThe impacted product is end-of-life and should be disconnected if still in use.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 91.48% | 0.997 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.