CVE-2012-1876: Code Injection
Published Jun 12, 2012
·Updated
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
Affected Software
57 affected components
All of the following
Microsoft Internet Explorer=6
Any of the following
Microsoft Windows 2003 Server=sp2
Microsoft Windows 2003 Server=sp2
Microsoft Windows Server 2003=sp2
Microsoft Windows XP=sp3
Microsoft Windows XP=sp2
All of the following
Microsoft Internet Explorer=7
Any of the following
Microsoft Windows 2003 Server=sp2
Microsoft Windows 2003 Server=sp2
Microsoft Windows Server 2003=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Vista=sp2
Microsoft Windows Vista=sp2
Microsoft Windows XP=sp3
Microsoft Windows XP=sp2
All of the following
Any of the following
Microsoft Internet Explorer=8
Microsoft Internet Explorer=9
Any of the following
Microsoft Windows 7
Microsoft Windows 7
Microsoft Windows 7=sp1
Microsoft Windows 7
Microsoft Windows 7=sp1
Microsoft Windows Server 2003=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=r2
Microsoft Windows Server 2008=r2
Microsoft Windows Vista=sp2
Microsoft Windows XP=sp3
Microsoft Windows XP=sp2
Microsoft Internet Explorer=6
Microsoft Windows 2003 Server=sp2
Microsoft Windows 2003 Server=sp2
Microsoft Windows Server 2003=sp2
Microsoft Windows XP=sp3
Microsoft Windows XP=sp2
Microsoft Internet Explorer=7
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=sp2
Microsoft Windows Vista=sp2
Microsoft Windows Vista=sp2
Microsoft Windows Vista=sp2
Microsoft Internet Explorer=8
Microsoft Internet Explorer=9
Microsoft Windows 7
Microsoft Windows 7
Microsoft Windows 7=sp1
Microsoft Windows 7
Microsoft Windows 7=sp1
Microsoft Windows Server 2008=sp2
Microsoft Windows Server 2008=r2
Microsoft Windows Server 2008=r2
Event History
Jun 12, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
Is Microsoft Windows vulnerable due to CVE-2012-1876?
Yes, CVE-2012-1876 can affect various Microsoft Windows operating systems running the vulnerable versions of Internet Explorer.