Exploitation Summary
CVE-2011-1345 has been observed exploited in the wild (reported by VulnCheck KEV).
Description
Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, as demonstrated by Stephen Fewer as the first of three chained vulnerabilities during a Pwn2Own competition at CanSecWest 2011, aka "Object Management Memory Corruption Vulnerability."
References (12)
Core 12
Core References
Various Sources x_refsource_misc
https://threatpost.com/en_us/blogs/pwn2own-winner-stephen-fewer-031011
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA11-102A.html
Various Sources x_refsource_misc
http://twitter.com/msftsecresponse/statuses/45646985998516224
Various Sources x_refsource_misc
http://twitter.com/aaronportnoy/statuses/45642180118855680
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1025327
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018
Various Sources x_refsource_misc
http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
Various Sources x_refsource_misc
http://www.computerworld.com/s/article/9214002/Safari_IE_hacked_first_at_Pwn2Own
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/46821
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12228
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66062
Various Sources x_refsource_misc
http://www.zdnet.com/blog/security/pwn2own-2011-ie8-on-windows-7-hijacked-with-3-vulnerabilities/8367
Scores
EPSS
0.4088
EPSS Percentile
98.5%
Details
VulnCheck KEV
2011-05-16
Status
published
Products (1)
microsoft/internet_explorer
8
Published
Mar 10, 2011
Tracked Since
Feb 18, 2026