PT-2010-2843 · Microsoft · Internet Explorer

Published 2010-03-26 · Updated 2021-07-23 · CVE-2010-1127

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 7

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash, via crafted JavaScript code. This can be achieved by setting the outerHTML or value property of an object returned by the createElement method.

Recommendations For Microsoft Internet Explorer versions 6 through 7, consider disabling the execution of JavaScript code from untrusted sources as a temporary workaround until a patch is available. Restrict access to the createElement method to minimize the risk of exploitation. Avoid using the outerHTML and value properties of objects returned by createElement in JavaScript code until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2010-1127

Affected Products

Internet Explorer

References · 4

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2010-01/0237.html · Exploit
• 🔥 http://securityreason.com/exploitalert/7731 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-1127 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2010-01/0278.html · Note