CVE-2013-2551-sample analysis and exploits and Defense-vulnerability warning-the black bar safety net

0x0 is written on the front VUPEN team in the Pwn2Own 2013 hacking contest using the vulnerability to compromise Windows 8 environment, IE10, then on their blog discloses technical details. According to VUPEN description of the vulnerability produced in the VGX. DLL module, in the VML language...

Microsoft Internet Explorer use-after-free vulnerability

VGX.DLL use-after-free vulnerability is actively exploitd in-the-wild...

Two New Vulnerabilities Linked to Latest IE Zero Day

UPDATE – Researchers at Websense said today they may have isolated two components within the VGX library that are being exploited by attackers targeting the latest Internet Explorer zero-day vulnerability. By combing through millions of Windows crash reports sent via the Windows Error Reporting...

CVE-2014-1776

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this iss...

Memory corruption

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this iss...

New Zero-Day Vulnerability CVE-2014-1776 Affects all Versions of Internet Explorer Browser

Microsoft confirmed a new Zero Day critical vulnerability in its browser Internet Explorer. Flaw affects all versions of Internet Explorer, starting with IE version 6 and including IE version 11. In a Security Advisory 2963983 released yesterday, Microsoft acknowledges a zero-day Internet Explore...

Microsoft Internet Explorer CMarkup use-after-free vulnerability

Overview Microsoft Internet Explorer contains a use-after-free vulnerability, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Internet Explorer contains a use-after-free vulnerability. This can allow for arbitrary code...

MS13-009 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 HttpClients::IE,...

MS13-009 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow

Exploit for windows platform in category remote exploits require 'msf/core' class Metasploit3 HttpClients::IE, :uaminver = "8.0", :uamaxver = "8.0", :javascript = true, :osname = OperatingSystems::WINDOWS, :rank = Rank def initializeinfo= superupdateinfoinfo, 'Name' = "MS13-009 Microsoft Internet...

ZDI-11-197: Microsoft Internet Explorer vgx.dll imagedata Remote Code Execution Vulnerability

ZDI-11-197: Microsoft Internet Explorer vgx.dll imagedata Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-197 June 14, 2011 -- CVE ID: CVE-2011-1266 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Microsoft -- Affected Products: Microsoft Interne...

Microsoft Internet Explorer VML内存破坏CVE-2011-1266远程代码执行漏洞

Bugtraq ID: 48173 CVE ID：CVE-2011-1266 Microsoft Internet Explorer是一款微软开发的WEB浏览器。 从DOM解析VML对象时vgx.dll存在缺陷，具体来说，在页面结构过程中处理Imagedata参数时存在故障代码。通过向imagedata对象动态分配属性，进程会访问释放内存，成功利用漏洞可以应用程序上下文执行任意代码 Microsoft Internet Explorer 7.0.5730 .11 Microsoft Internet Explorer 8.0.7600.16385 Microsoft Internet...

Microsoft Internet Explorer vgx.dll imagedata Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within vgx.dll while...

Microsoft Internet Explorer - 'VML' Fill Method Code Execution (MS06-055) (Metasploit)

$Id: ms06055vmlmethod.rb 9669 2010-07-03 03:13:45Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Integer overflow

Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite...

Microsoft GDI+ VML基于堆的缓冲区溢出漏洞（MS08-052）

BUGTRAQ ID: 31018 CVE ID：CVE-2007-5348 CNCVE ID：CNCVE-20085348 Microsoft Windows是一款微软开发的操作系统。 Microsoft Windows GDI+库不正确处理梯度大小，远程攻击者可以利用漏洞进行基于堆的缓冲区溢出，可导致任意代码执行。 GDI+库处理内存分配时存在错误，部分畸形的梯度填充输入可导致应用程序破坏堆，允许任意代码执行。 攻击者必须诱使用户使用受此GDI+函数影响的应用程序来渲染文档，可通过链接，文档查看，EMAIL消息来触发。 iDefense Labs证实此漏洞影响Microsoft...

CVE-2007-5348

Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, Office XP SP3, Office 2003 SP2 and SP3, 2007 Microsoft Office System Gold and SP1, Visio 2002 SP2, PowerPoint Viewer 2003, Works 8, Digital Image Suite...

Microsoft IE向量标记语言VGX.DLL远程堆溢出漏洞（MS07-050）

BUGTRAQ ID: 25310 CVECAN ID: CVE-2007-1749 Internet Explorer是微软发布的非常流行的WEB浏览器。 IE的VML在处理压缩的数据时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 VGX.DLL是IE中负责渲染VML的组件，该组件中的CDownloadSink类实现处理从VML中内嵌URL所下载的数据。例如，以下VML会下载由VGX.DLL!CDownloadSink::OnDataAvailable处理的额外内容： v:rect v:imagedata src="http://malice/compressed.emz...

EEYE: VGX.DLL Compressed Content Heap Overflow Vulnerability

VGX.DLL Compressed Content Heap Overflow Vulnerability Release Date: August 14, 2007 Date Reported: October 24, 2006 Severity: High Code Execution Systems Affected: Internet Explorer 6 SP1 - Windows 2000 SP4 Internet Explorer 6 SP1 - Windows XP SP1 Internet Explorer 6 SP2 - Windows XP SP2 Interne...

Microsoft Windows VML compressed content integer underflow

Overview Microsoft Windows VML fails to properly handle compressed content, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft IE version 5.0 and higher supports the Vector Markup Language VML, which is a set of XML tags for...

VulnCheck KEV: CVE-2007-0024

Integer overflow in the Vector Markup Language VML implementation vgx.dll in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server 2003, and Server 2003 SP1 allows remote attackers to execute arbitrary code via a crafted web page that contains unspecified integer...