CVE-2008-3475

Опубликовано: 15 окт. 2008

Источник: nvd

CVSS3: 8.8

CVSS2: 9.3

EPSS Средний

Описание

Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."

Ссылки

http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html
Issue Tracking
Third Party Advisory
http://marc.info/?l=bugtraq&m=122479227205998&w=2
Mailing List
http://www.securityfocus.com/archive/1/497380/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/31617
Broken Link
Patch
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1021047
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-288A.html
Broken Link
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2008/2809
Broken Link
http://www.zerodayinitiative.com/advisories/ZDI-08-069/
Third Party Advisory
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/45563
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45565
Third Party Advisory
VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13151
Broken Link
http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html
Issue Tracking
Third Party Advisory
http://marc.info/?l=bugtraq&m=122479227205998&w=2
Mailing List
http://www.securityfocus.com/archive/1/497380/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/31617
Broken Link
Patch
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1021047
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-288A.html
Broken Link
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2008/2809
Broken Link
http://www.zerodayinitiative.com/advisories/ZDI-08-069/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*

cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:*

Одно из

cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:-:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:*:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp1:*:*:-:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:*:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.59201

Средний

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-908

Связанные уязвимости

GHSA-hj95-cvvq-rc83

CVSS3: 8.8

github

почти 4 года назад

EPSS

Процентиль: 98%

0.59201

Средний

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-908