| Description: | Summary:
This host is missing a critical security update according to
Microsoft Bulletin MS12-037.
Vulnerability Insight:
Multiple vulnerabilities are due to the way that Internet Explorer,
- Handles content using specific strings when sanitizing HTML.
- Handles EUC-JP character encoding.
- Processes NULL bytes, which allows to disclose content from the process
memory.
- Accesses an object that has been deleted, which allows to corrupt memory
using Internet Explorer Developer Toolbar.
- Accesses an object that does not exist, when handling the 'Col' element.
- Accesses an object that has been deleted, when handling Same ID Property,
'Title' element, 'OnBeforeDeactivate' event, 'insertRow' method and
'OnRowsInserted' event allows to corrupt memory.
- Accesses an undefined memory location, when handling the
'insertAdjacentText' method allows to corrupt memory.
- Handles 'Scrolling' event.
Vulnerability Impact:
Successful exploitation could allow remote attackers to gain sensitive
information or execute arbitrary code in the context of the application.
Affected Software/OS:
Microsoft Internet Explorer version 6.x/7.x/8.x/9.x.
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
