Overview
Microsoft Internet Explorer 8 contains a use-after-free vulnerability that can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
Description
Microsoft Internet Explorer 8 contains a use-after-free vulnerability. This can allow for arbitrary code execution. Additional details may be found in the Zero Day Initiative advisory ZDI-14-140. |
Impact
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code. |
Solution
Apply an Update Users should upgrade to Internet Explorer 11. |
Use the Microsoft Enhanced Mitigation Experience Toolkit |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| Temporal | 6.5 | E:H/RL:W/RC:C |
| Environmental | 8.2 | CDP:MH/TD:H/CR:H/IR:H/AR:L |
References
Acknowledgements
This vulnerability was discovered by Peter 'corelanc0d3r' Van Eeckhoutte and coordinated by the Zero Day Initiative.
This document was written by Jared Allar.
Other Information
| CVE IDs: | CVE-2014-1770 |
| Date Public: | 2014-05-21 |
| Date First Published: | 2014-05-21 |
| Date Last Updated: | 2014-05-23 16:39 UTC |
| Document Revision: | 12 |