SB2011041201 - Multiple vulnerabilities in Microsoft Internet Explorer
Published: April 12, 2011 Updated: December 27, 2016
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2011-1245)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/U:Green
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper handling of Javascript during certain processes. A remote attacker can create a specially crafted Web page, trick the victim into visiting it and bypass cross-domain security restrictions and obtain sensitive information from another security zone or domain.
Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.
2) Information disclosure (CVE-ID: CVE-2011-1244)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/U:Green
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to an error related to frame tags. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and hijack the victim's click actions to obtain sensitive information from different domains.
Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.
3) “Use-after-free” error (CVE-ID: CVE-2011-0346)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error n the ReleaseInterface() function within the mshtml.dll library when handling circular references between JScript objects and DOM objects. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
4) Use-after-free error (CVE-ID: CVE-2011-0094)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to use-after-free error when handling layout objects that have not been correctly initialized or have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Remediation
Install update from vendor's website.