PT-2003-1308 · Microsoft · Windows Script Engine For Jscript

Roland Postle · Publicado 2003-03-21 · Atualizado 2019-04-30 · CVE-2003-0010

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows Script Engine for JScript (JScript.dll) (affected versions not specified)

Description The issue is related to an integer overflow in the JsArrayFunctionHeapSort function. This allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail that uses a large array index value, enabling a heap-based buffer overflow attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2003-0010

Produtos afetados

Windows Script Engine For Jscript

Referências · 10

• http://securityfocus.com/bid/7146 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-0010 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A134 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A200 · Nota
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=26 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A794 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A795 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-008 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=104812108307645&w=2 · Nota
• http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0139.html · Nota