CVE-2011-1997

Related Files

iDefense Security Advisory 10.11.11 - Internet Explorer

Posted Oct 13, 2011

Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 10.11.11 - Remote exploitation of a memory corruption vulnerability in Microsoft Corp.'s Internet Explorer could allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability occurs when a Javascript event handler such as "onload" is set to a Javascript object's attributes or childNodes collection. A event object is created and this object's memory is later freed; however, a reference to the object remains. When the reference is later used to access the event object, this now-invalid memory is treated as a valid object. The corrupt object's vtable is used to make an indirect function call. This may result in the execution of arbitrary code. Microsoft Internet Explorer 6 is vulnerable.

tags | advisory, remote, arbitrary, javascript

advisories | CVE-2011-1997

SHA-256 | a4cc81d5475470608b44363a528ccde05f1dbe3da1d6719cf0e9b5d63761b2d0

Download | Favorite | View