|
|
|
|
| |
Credit:
The information has been provided by Stephen Fewer.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-12-036/
|
| |
Vulnerable Systems:
* Internet Explorer
User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The flaw exists within the handling of VML element positioning. When appending a VML element to a textArea element a reference to a cDispScroller object can be improperly freed. The object is can be reused, and due to this object being freed, a later allocation can be located in this memory region. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the process.
Vendor Status:
Microsoft has issued an update to correct this vulnerability.
Patch Availability:
http://technet.microsoft.com/en-us/security/bulletin/MS12-010
CVE Information:
CVE-2012-0155
Disclosure Timeline:
2011-11-29 - Vulnerability reported to vendor
2012-02-22 - Coordinated public release of advisory
|
|
|
|
|
