8.8Alta
KEV
CVE-2013-3897Microsoft Internet Explorer Use-After-Free Vulnerability
Explotación conocida — Microsoft Internet Explorer Use-After-Free Vulnerability
CISA confirmó el 03.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 24.03.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-3897
Descripción
Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."
Debilidad (CWE):
CWE-416
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Referencias y parches
- http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-target… Broken LinkVendor Advisory
- TA13-288A third-party-advisoryThird Party AdvisoryUS Government Resource
- MS13-080 vendor-advisoryPatchVendor Advisory
- oval:org.mitre.oval:def:18989 vdb-entrysignatureBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3897 US Government Resource
Coincidencias CPE (NVD) (6)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*