CVE-2013-3893Microsoft Internet Explorer Resource Management Errors Vulnerability
Explotación conocida — Microsoft Internet Explorer Resource Management Errors Vulnerability
CISA confirmó el 12.08.2025 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 02.09.2025.
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080 ; https://nvd.nist.gov/vuln/detail/CVE-2013-3893
Descripción
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Referencias y parches
- JVNDB-2013-000093 third-party-advisoryThird Party Advisory
- JVN#27443259 third-party-advisoryThird Party Advisory
- http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-target… Vendor Advisory
- 62453 vdb-entryBroken Link
- oval:org.mitre.oval:def:18665 vdb-entrysignatureBroken Link
- TA13-288A third-party-advisoryUS Government Resource
- http://technet.microsoft.com/security/advisory/2887505 Vendor Advisory
- MS13-080 vendor-advisoryVendor Advisory
- http://pastebin.com/raw.php?i=Hx1L5gu6 Exploit
- http://blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx Exploit
- http://packetstormsecurity.com/files/162585/Microsoft-Internet-Explorer-8-SetMouseCapture-Use-After-Free.html Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3893 US Government Resource
Coincidencias CPE (NVD) (7)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:developer-preview:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:release-preview:*:*:*:*:*:*