CVEvulnerability
CVE-2007-3902
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-12-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-189, CWE-399
Description
Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability."
Affected configurations
• microsoft ie 5.x
• microsoft ie 6.0
• microsoft internet explorer 5
• microsoft internet explorer 5.01
• microsoft internet explorer 5.1
• microsoft internet explorer 5.2.3
• microsoft internet explorer 5.5
• microsoft internet explorer 6
• microsoft internet explorer 6.0
• microsoft internet explorer 6.0.2600
• microsoft internet explorer 6.0.2800
• microsoft internet explorer 6.0.2800.1106
• microsoft internet explorer 6.0.2900
• microsoft internet explorer 6.0.2900.2180
• microsoft internet explorer 7
• microsoft internet explorer 7.0
• microsoft internet explorer 7.0.5730.11
Related
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=631 labs.idefense.com
- http://secunia.com/advisories/28036 Vendor Advisory
- http://securitytracker.com/id?1019078 securitytracker.com
- http://www.securityfocus.com/archive/1/484887/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/485268/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/26506 www.securityfocus.com
- http://www.us-cert.gov/cas/techalerts/TA07-345A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/4184 Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-073.html www.zerodayinitiative.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-069 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38713 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4582 oval.cisecurity.org
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=631 labs.idefense.com
- http://secunia.com/advisories/28036 Vendor Advisory
- http://securitytracker.com/id?1019078 securitytracker.com
- http://www.securityfocus.com/archive/1/484887/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/archive/1/485268/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/26506 www.securityfocus.com
- http://www.us-cert.gov/cas/techalerts/TA07-345A.html US Government Resource
- http://www.vupen.com/english/advisories/2007/4184 Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-073.html www.zerodayinitiative.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-069 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38713 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4582 oval.cisecurity.org