vulnwire
8.8high

CVE-2008-0077in critical feed

Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by as…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
37.2%
percentile 99%
Public exploits
0
none known

Use-after-free vulnerability in Microsoft Internet Explorer 6 SP1, 6 SP2, and and 7 allows remote attackers to execute arbitrary code by assigning malformed values to certain properties, as demonstrated using the by property of an animateMotion SVG element, aka "Property Memory Corruption Vulnerability."

Exploit prediction (EPSS)

37.19% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

References

  • securityfocus.com /archive/1/488048/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • marc.info /?l=bugtraq&m=120361015026386&w=2 · vendor-advisory, x_refsource_HP, x_transferred
  • securityfocus.com /bid/27666 · vdb-entry, x_refsource_BID, x_transferred
  • kb.cert.org /vuls/id/228569 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • zerodayinitiative.com /advisories/ZDI-08-006.html · x_refsource_MISC, x_transferred
  • securitytracker.com /id?1019380 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • us-cert.gov /cas/techalerts/TA08-043C.html · third-party-advisory, x_refsource_CERT, x_transferred
  • labs.idefense.com /intelligence/vulnerabilities/display.php?id=661 · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5396 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • vupen.com /english/advisories/2008/0512/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2008/ms08-010 · vendor-advisory, x_refsource_MS, x_transferred
  • secunia.com /advisories/28903 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.