CVE-2008-3475

HIGH

Microsoft Internet Explorer 6 - Uninitialized Memory Corruption

Title source: llm
STIX 2.1

Description

Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."

References (12)

Core 12
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45563
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/497380/100/0/threaded
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=122479227205998&w=2
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058
Broken Link vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2809
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021047
Third Party Advisory, VDB Entry x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-08-069/
Broken Link, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA08-288A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/45565
Broken Link, Patch, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31617

Scores

CVSS v3 8.8
EPSS 0.3986
EPSS Percentile 98.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-908
Status published
Products (3)
microsoft/internet_explorer 5.01 sp4
microsoft/internet_explorer 6 sp1 (2 CPE variants)
microsoft/internet_explorer 7.0
Published Oct 15, 2008
Tracked Since Feb 18, 2026