Product:
Internet Explorer
Summary
A use-after-free vulnerability in the CDisplayPointer class in mshtml.dll allows remote attackers to execute arbitrary code or cause a denial of service through crafted JavaScript code that uses the onpropertychange event handler. This vulnerability was actively exploited in the wild in September and October 2013.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2013-3897 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious JavaScript code that triggers the onpropertychange event handler in Internet Explorer. When a user visits a specially crafted webpage, the JavaScript executes, leading to memory corruption and potentially allowing the attacker to execute arbitrary code on the user’s system.
Affected Products
- Internet Explorer 6: Vulnerable to memory corruption via crafted JavaScript.
- Internet Explorer 7: Vulnerable to memory corruption via crafted JavaScript.
- Internet Explorer 8: Vulnerable to memory corruption via crafted JavaScript.
- Internet Explorer 9: Vulnerable to memory corruption via crafted JavaScript.
- Internet Explorer 10: Vulnerable to memory corruption via crafted JavaScript.
- Internet Explorer 11: Vulnerable to memory corruption via crafted JavaScript.
Mitigation
To mitigate this vulnerability, users should apply the updates provided by Microsoft as per their instructions. Keeping the browser updated is crucial to protect against such vulnerabilities.