CVE-2013-3897

Microsoft Internet Explorer Use-After-Free Vulnerability

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

*SSVC

Descriptions

Use-after-free vulnerability in the CDisplayPointer class in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript code that uses the onpropertychange event handler, as exploited in the wild in September and October 2013, aka "Internet Explorer Memory Corruption Vulnerability."

Vulnerabilidad de uso después de liberación en la clase CDisplayPointer en mshtml.dll en Microsoft Internet Explorer 6 a 11, que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de código JavaScript diseñado que utiliza el controlador de eventos onpropertychange, como fue explotado activamente en septiembre y octubre de 2013, también conocido como "Internet Explorer Memory Corruption Vulnerability."

A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.

*Credits: N/A

CVSS Scores

NISTv2 9.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-06-03 CVE Reserved
2013-10-09 CVE Published
2013-10-15 First Exploit
2022-03-03 Exploited in Wild
2022-03-24 KEV Due Date
2024-08-06 CVE Updated
2024-08-29 EPSS Updated

CWE

CWE-399: Resource Management Errors

CAPEC

References (5)

URL	Tag	Source
http://www.us-cert.gov/ncas/alerts/TA13-288A	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18989	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/28974	2013-10-15

URL	Date	SRC

URL	Date	SRC
http://blogs.technet.com/b/srd/archive/2013/10/08/ms13-080-addresses-two-vulnerabilities-under-limited-targeted-attacks.aspx	2018-10-12
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080	2018-10-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				6 Search vendor "Microsoft" for product "Internet Explorer" and version "6"		-		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				7 Search vendor "Microsoft" for product "Internet Explorer" and version "7"		-		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				8 Search vendor "Microsoft" for product "Internet Explorer" and version "8"		-		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				9 Search vendor "Microsoft" for product "Internet Explorer" and version "9"		-		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				10 Search vendor "Microsoft" for product "Internet Explorer" and version "10"		-		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				11 Search vendor "Microsoft" for product "Internet Explorer" and version "11"		developer-preview		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				11 Search vendor "Microsoft" for product "Internet Explorer" and version "11"		release-preview		Affected