CVE-2012-0012: Medium severity Microsoft Internet Explorer vulnerability

Published Feb 14, 2012

Updated

Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site, aka "Null Byte Information Disclosure Vulnerability."

Affected Software

7 affected components

Microsoft Internet Explorer=9

Microsoft Windows 7

Microsoft Windows 7=sp1

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=r2

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Vista=sp2

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-010

Event History

Feb 14, 2012

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause a user to visit a crafted web site. The vulnerability is remotely exploitable and does not require authentication.

What information could be exposed?

Successful exploitation can allow an attacker to read data from arbitrary locations in the affected process's memory. The provided impact information indicates confidentiality impact only, with no stated integrity or availability impact.

Is a fix available?

Yes. A patch is available for this vulnerability.

CVE-2012-0012: Medium severity Microsoft Internet Explorer vulnerability

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Is a fix available?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What information could be exposed?

Is a fix available?