CVE-2012-4792 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not prop...
HighCVSS 8.8
EPSS 78.8%
CISA KEV
added 2024-07-23 · due 2024-08-13
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
CISA Known Exploited Vulnerability
- Date added
- 2024-07-23
- Due date (FCEB)
- 2024-08-13
- Ransomware use
- Unknown
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 6 | No fix listed |
| Microsoft internet explorer | = 7 | No fix listed |
| Microsoft internet explorer | = 8 | No fix listed |
| Microsoft ie | >= 6.0, <= 8.0 | No fix listed |
References
- blog.fireeye.com broken-link
- blogs.technet.com broken-link
- blogs.technet.com broken-link
- eromang.zataz.com third-party-advisory
- labs.alienvault.com broken-link
- packetstormsecurity.com third-party-advisory vdb-entry
- technet.microsoft.com patch vendor-advisory
- VU#154201 third-party-advisory us-government-resource
- TA13-008A third-party-advisory us-government-resource
- TA13-015A third-party-advisory us-government-resource
- MS13-008 patch vendor-advisory
- github.com third-party-advisory
- oval:org.mitre.oval:def:16361 broken-link signature vdb-entry
- www.cisa.gov government-resource us-government-resource