8.8High
KEV
Used in ransomware
CVE-2013-2551Microsoft Internet Explorer Use-After-Free Vulnerability
Known exploited — Microsoft Internet Explorer Use-After-Free Vulnerability
CISA confirmed this vulnerability is used in real attacks on 28.03.2022. Remediation deadline for US federal agencies: 18.04.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-2551
Description
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
Weakness (CWE):
CWE-416
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
References and patches
- MS13-037 vendor-advisoryPatchVendor Advisory
- TA13-134A third-party-advisoryThird Party AdvisoryUS Government Resource
- http://twitter.com/VUPEN/statuses/309479075385327617 Broken Link
- http://twitter.com/thezdi/statuses/309452625173176320 Not Applicable
- oval:org.mitre.oval:def:16317 vdb-entrysignatureBroken Link
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157 Broken LinkThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2551 US Government Resource
CPE matches (NVD) (5)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:-:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*