CVE-2009-1530
Microsoft Internet Explorer 7 - Use-After-Free via HTML Document Node Manipulation
Title source: llmDescription
Use-after-free vulnerability in Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code by repeatedly adding HTML document nodes and calling event handlers, which triggers an access of an object that (1) was not properly initialized or (2) is deleted, aka "HTML Objects Memory Corruption Vulnerability."
References (8)
Core 8
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/504209/100/0/threaded
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1538
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-09-038
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-160A.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1022350
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6294
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/54949
Scores
EPSS
0.3394
EPSS Percentile
98.2%
Details
CWE
CWE-399
Status
published
Products (4)
microsoft/internet_explorer
6 (2 CPE variants)
microsoft/internet_explorer
7
microsoft/internet_explorer
5.01 (2 CPE variants)
microsoft/internet_explorer
8
Published
Jun 10, 2009
Tracked Since
Feb 18, 2026