CVE-2013-3846: Use After Free

Published Dec 29, 2013

Updated

Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CSpliceTreeEngine::InsertSplice object in an HTML document, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3143 and CVE-2013-3161.

Affected Software

2 affected components

Microsoft Internet Explorer=9

Microsoft Internet Explorer=10

Event History

Dec 29, 2013

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3846?

CVE-2013-3846 has a CVSS score of 6.8, indicating it is of medium severity.

How do I fix CVE-2013-3846?

To fix CVE-2013-3846, users should install the security updates provided by Microsoft for Internet Explorer 9 and 10.

What are the affected versions of software related to CVE-2013-3846?

CVE-2013-3846 affects Microsoft Internet Explorer version 9 and version 10.

What types of attacks can exploit CVE-2013-3846?

CVE-2013-3846 can be exploited to execute arbitrary code or cause a denial of service through memory corruption.

Is CVE-2013-3846 specific to only Internet Explorer?

Yes, CVE-2013-3846 specifically affects Microsoft Internet Explorer versions 9 and 10.