agnutam
@blutmagie.de
| Internet Explorer Data Binding Memory Corruption Vuln
A vulnerability has been discovered in Internet Explorer, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a use-after-free error when composed HTML elements are bound to the same data source. This can be exploited to dereference freed memory via a specially crafted HTML document.
Successful exploitation allows execution of arbitrary code.
NOTE: Reportedly, the vulnerability is currently being actively exploited.
The vulnerability is confirmed in Internet Explorer 7 on a fully patched Windows XP SP3 and in Internet Explorer 6 on a fully patched Windows XP SP2. Other versions may also be affected.
Solution:
Do not browse untrusted websites or follow untrusted links.
Provided and/or discovered by:
Reported as a 0-day.
»secunia.com/advisories/33089/
Best to stick to open source browsers. Reap it, bitches. |
|
tempnexus
Premium
join:1999-08-11
Boston, MA
1 edit | »Mozilla to pull antiphishing feature from Firefox 2
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Kind of makes this issue look like Pluto eh? |
|
Kayrac
Premium
join:2001-09-29
Rochester, NH
| reply to agnutam
certain os's are less vulnerable
vista sp1 being one, windows server, being 2
»www.microsoft.com/technet/securi···051.mspx
that being said, repost
»Microsoft Security Advisory (961051)
open source != safety, no point releasing a 0day for a browser 6 people use  |
|
