CVE-2008-4844: Use After Free
Use-after-free vulnerability in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer 5.01, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via DSO bindings involving (1) an XML Island, (2) XML DSOs, or (3) Tabular Data Control (TDC) in a crafted HTML or XML document, as demonstrated by nested SPAN or MARQUEE elements, and exploited in the wild in December 2008.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4844?
CVE-2008-4844 has been rated as critical due to its potential to allow remote code execution.
How do I fix CVE-2008-4844?
To fix CVE-2008-4844, users should apply the latest security updates provided by Microsoft for Internet Explorer.
Who is affected by CVE-2008-4844?
CVE-2008-4844 affects users of Microsoft Internet Explorer versions 5.01, 6, 6 SP1, and 7.
What type of vulnerability is CVE-2008-4844?
CVE-2008-4844 is a use-after-free vulnerability found in the mshtml.dll component of Internet Explorer.
What can an attacker do with CVE-2008-4844?
An attacker exploiting CVE-2008-4844 can execute arbitrary code on the victim's machine.