CVE-2007-3902 Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression....
HighCVSS 9.3
EPSS 35.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 5.x | No fix listed |
| Microsoft ie | = 6.0-sp1 | No fix listed |
| Microsoft ie | = 6.0-sp2 | No fix listed |
| Microsoft internet explorer | = 5 | No fix listed |
| Microsoft internet explorer | = 5.01 | No fix listed |
| Microsoft internet explorer | = 5.1 | No fix listed |
| Microsoft internet explorer | = 5.01-sp1 | No fix listed |
| Microsoft internet explorer | = 5.01-sp2 | No fix listed |
| Microsoft internet explorer | = 5.01-sp3 | No fix listed |
| Microsoft internet explorer | = 5.01-sp4 | No fix listed |
| Microsoft internet explorer | = 5.2.3 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-preview | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6 | No fix listed |
| Microsoft internet explorer | = 6-sp1 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| Microsoft internet explorer | = 6.0.2600 | No fix listed |
| Microsoft internet explorer | = 6.0.2800 | No fix listed |
| Microsoft internet explorer | = 6.0.2800.1106 | No fix listed |
| Microsoft internet explorer | = 6.0.2900 | No fix listed |
| Microsoft internet explorer | = 6.0.2900.2180 | No fix listed |
| Microsoft internet explorer | = 7 | No fix listed |
| Microsoft internet explorer | = 7.0 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 7.0-beta | No fix listed |
| Microsoft internet explorer | = 7.0-beta1 | No fix listed |
| Microsoft internet explorer | = 7.0-beta2 | No fix listed |
| Microsoft internet explorer | = 7.0-beta3 | No fix listed |
| Microsoft internet explorer | = 7.0.5730.11 | No fix listed |
References
- 20071211 Microsoft Internet Explorer JavaScript setExpression Heap Corruption Vulnerability third-party-advisory
- 28036 third-party-advisory vendor-advisory
- 1019078 vdb-entry
- 20071211 ZDI-07-073: Microsoft Internet Explorer setExpression Vulnerability mailing-list
- SSRT071506 vendor-advisory
- 26506 vdb-entry
- TA07-345A third-party-advisory us-government-resource
- ADV-2007-4184 vdb-entry vendor-advisory
- www.zerodayinitiative.com
- MS07-069 vendor-advisory
- ie-uninit-object-code-execution(38713) vdb-entry
- oval:org.mitre.oval:def:4582 signature vdb-entry