CVE-2009-3673

Internet Explorer 7 and 8 - Remote Code Execution via Uninitialized Memory Corruption

Title source: llm
STIX 2.1

Description

Microsoft Internet Explorer 7 and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6519
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-342A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1023293

Scores

EPSS 0.2535
EPSS Percentile 97.7%

Details

CWE
CWE-94
Status published
Products (10)
microsoft/internet_explorer 5.0.1 sp4
microsoft/internet_explorer 6 sp1 (2 CPE variants)
microsoft/internet_explorer 7
microsoft/internet_explorer 8
microsoft/windows_2000
microsoft/windows_7
microsoft/windows_server_2003
microsoft/windows_server_2008 (8 CPE variants)
microsoft/windows_vista (3 CPE variants)
microsoft/windows_xp (4 CPE variants)
Published Dec 09, 2009
Tracked Since Feb 18, 2026