vulnwire
9.3crit

CVE-2008-4844in critical feed4 exploits

Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
66.5%
percentile 99%
Public exploits
4
Metasploit · Exploit-DB

Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular Data Control (TDC) in a crafted HTML or XML document, as demonstrated by nested SPAN or MARQUEE elements, and exploited in the wild in December 2008.

Exploit prediction (EPSS)

66.51% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

  • Metasploit exploit/windows/browser/ms08_078_xml_corruption MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption · metasploit exploit, normal rank · 2008-12-07
  • EDB-7410 Microsoft Internet Explorer (Windows Vista) - XML Parsing Buffer Overflow · remote · 2008-12-10
  • EDB-7403 Microsoft Internet Explorer - XML Parsing Remote Buffer Overflow · remote · 2008-12-10
  • EDB-16583 Microsoft Internet Explorer - Data Binding Memory Corruption (MS08-078) (Metasploit) · remote · 2010-09-20

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

References

  • scanw.com /blog/archives/303 · x_refsource_MISC, x_transferred
  • securitytracker.com /id?1021381 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • isc.sans.org /diary.html?storyid=5458 · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/7583 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • us-cert.gov /cas/techalerts/TA08-352A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • code.google.com /p/inception-h2hc/ · x_refsource_MISC, x_transferred
  • kb.cert.org /vuls/id/493881 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6007 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securityfocus.com /bid/32721 · vdb-entry, x_refsource_BID, x_transferred
  • exploit-db.com /exploits/7477 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • marc.info /?l=bugtraq&m=123015308222620&w=2 · vendor-advisory, x_refsource_HP, x_transferred
  • breakingpointsystems.com /community/blog/patch-tuesdays-and-drive-by-sundays · x_refsource_MISC, x_transferred
  • vupen.com /english/advisories/2008/3391 · vdb-entry, x_refsource_VUPEN, x_transferred
  • avertlabs.com /research/blog/index.php/2008/12/09/yet-another-unpatched-drive-by-exploit-found-on-the-we · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/7403 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • us-cert.gov /cas/techalerts/TA08-344A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • exploit-db.com /exploits/7410 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2008/ms08-078 · vendor-advisory, x_refsource_MS, x_transferred
  • secunia.com /advisories/33089 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • microsoft.com /technet/security/advisory/961051.mspx · x_refsource_CONFIRM, x_transferred
  • blogs.msdn.com /sdl/archive/2008/12/18/ms08-078-and-the-sdl.aspx · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.