Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directi…

Exploit prediction (EPSS)

33.54% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

• EDB-8152 Microsoft Internet Explorer 7 - Memory Corruption (MS09-002) · remote · 2009-03-04
• EDB-8082 Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (MS09-002) · remote · 2009-02-20
• EDB-8080 Microsoft Internet Explorer 7 - Memory Corruption (MS09-002) · remote · 2009-02-20
• EDB-8079 Microsoft Internet Explorer 7 (Windows XP SP2) - Memory Corruption (MS09-002) · remote · 2009-02-20

CVSS scores

Classification

Weakness

• CWE-399 Resource Management Errors

References

• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6081 · vdb-entry, signature, x_refsource_OVAL, x_transferred
• vupen.com /english/advisories/2009/0389 · vdb-entry, x_refsource_VUPEN, x_transferred
• zerodayinitiative.com /advisories/ZDI-09-012/ · x_refsource_MISC, x_transferred
• us-cert.gov /cas/techalerts/TA09-041A.html · third-party-advisory, x_refsource_CERT, x_transferred
• docs.microsoft.com /en-us/security-updates/securitybulletins/2009/ms09-002 · vendor-advisory, x_refsource_MS, x_transferred

Sources

• CVE List: CVE-2009-0076
• NVD: CVE-2009-0076

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.