CVE-2008-4844
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 66.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular Data Control (TDC) in a crafted HTML or XML document, as demonstrated by nested SPAN or MARQUEE elements, and exploited in the wild in December 2008.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 66.51% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- microsoft/internet explorer
- Source
- secure@microsoft.com
References
- http://blogs.msdn.com/sdl/archive/2008/12/18/ms08-078-and-the-sdl.aspx
- http://code.google.com/p/inception-h2hc/
- http://isc.sans.org/diary.html?storyid=5458Exploit
- http://marc.info/?l=bugtraq&m=123015308222620&w=2
- http://secunia.com/advisories/33089Patch, Vendor Advisory
- http://www.avertlabs.com/research/blog/index.php/2008/12/09/yet-another-unpatched-drive-by-exploit-found-on-the-web/
- http://www.breakingpointsystems.com/community/blog/patch-tuesdays-and-drive-by-sundays
- http://www.kb.cert.org/vuls/id/493881US Government Resource
- http://www.microsoft.com/technet/security/advisory/961051.mspxVendor Advisory
- http://www.scanw.com/blog/archives/303
- http://www.securityfocus.com/bid/32721
- http://www.securitytracker.com/id?1021381
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.us-cert.gov/cas/techalerts/TA08-352A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3391Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-078
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6007
- https://www.exploit-db.com/exploits/7403
- https://www.exploit-db.com/exploits/7410
- https://www.exploit-db.com/exploits/7477
- https://www.exploit-db.com/exploits/7583
- http://blogs.msdn.com/sdl/archive/2008/12/18/ms08-078-and-the-sdl.aspx
- http://code.google.com/p/inception-h2hc/
- http://isc.sans.org/diary.html?storyid=5458Exploit
- http://marc.info/?l=bugtraq&m=123015308222620&w=2
- http://secunia.com/advisories/33089Patch, Vendor Advisory
- http://www.avertlabs.com/research/blog/index.php/2008/12/09/yet-another-unpatched-drive-by-exploit-found-on-the-web/
- http://www.breakingpointsystems.com/community/blog/patch-tuesdays-and-drive-by-sundays
- http://www.kb.cert.org/vuls/id/493881US Government Resource
- http://www.microsoft.com/technet/security/advisory/961051.mspxVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.