8.8Hoch
KEV
CVE-2013-3897Microsoft Internet Explorer Use-After-Free Vulnerability
Bekannt ausgenutzt — Microsoft Internet Explorer Use-After-Free Vulnerability
CISA hat am 03.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 24.03.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-3897
Beschreibung
Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."
Schwachstellentyp (CWE):
CWE-416
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Referenzen und Patches
- http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-target… Broken LinkVendor Advisory
- TA13-288A third-party-advisoryThird Party AdvisoryUS Government Resource
- MS13-080 vendor-advisoryPatchVendor Advisory
- oval:org.mitre.oval:def:18989 vdb-entrysignatureBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3897 US Government Resource
CPE-Treffer (NVD) (6)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*