CVE-2013-3893Microsoft Internet Explorer Resource Management Errors Vulnerability
Bekannt ausgenutzt — Microsoft Internet Explorer Resource Management Errors Vulnerability
CISA hat am 12.08.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 02.09.2025.
Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 ; https://nvd.nist.gov/vuln/detail/CVE-2013-3893
Beschreibung
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Referenzen und Patches
- JVNDB-2013-000093 third-party-advisoryThird Party Advisory
- JVN#27443259 third-party-advisoryThird Party Advisory
- http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-target… Vendor Advisory
- 62453 vdb-entryBroken Link
- oval:org.mitre.oval:def:18665 vdb-entrysignatureBroken Link
- TA13-288A third-party-advisoryUS Government Resource
- http://technet.microsoft.com/security/advisory/2887505 Vendor Advisory
- MS13-080 vendor-advisoryVendor Advisory
- http://pastebin.com/raw.php?i=Hx1L5gu6 Exploit
- http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx Exploit
- http://packetstormsecurity.com/files/162585/Microsoft-Internet-Explorer-8-SetMouseCapture-Use-After-Free.html Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3893 US Government Resource
CPE-Treffer (NVD) (7)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:developer-preview:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:release-preview:*:*:*:*:*:*