PT-2010-2843 · Microsoft · Internet Explorer

Publicado 2010-03-26 · Atualizado 2021-07-23 · CVE-2010-1127

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 7

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via crafted JavaScript code. This can be achieved by setting the outerHTML or value property of an object returned by the createElement method.

Recommendations For Microsoft Internet Explorer versions 6 through 7, consider disabling the execution of JavaScript code from untrusted sources as a temporary workaround until a patch is available. Restrict access to the createElement method to minimize the risk of exploitation. Avoid using the outerHTML and value properties of objects returned by createElement in JavaScript code until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2010-1127

Produtos afetados

Internet Explorer

Referências · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2010-01/0237.html · Exploit
• 🔥 http://securityreason.com/exploitalert/7731 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1127 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2010-01/0278.html · Nota