8.8Hoch
KEV
In Ransomware genutzt
CVE-2013-2551Microsoft Internet Explorer Use-After-Free Vulnerability
Bekannt ausgenutzt — Microsoft Internet Explorer Use-After-Free Vulnerability
CISA hat am 28.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 18.04.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-2551
Beschreibung
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
Schwachstellentyp (CWE):
CWE-416
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Referenzen und Patches
- MS13-037 vendor-advisoryPatchVendor Advisory
- TA13-134A third-party-advisoryThird Party AdvisoryUS Government Resource
- http://twitter.com/VUPEN/statuses/309479075385327617 Broken Link
- http://twitter.com/thezdi/statuses/309452625173176320 Not Applicable
- oval:org.mitre.oval:def:16317 vdb-entrysignatureBroken Link
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 Broken LinkThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2551 US Government Resource
CPE-Treffer (NVD) (5)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:-:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*