Microsoft Internet Explorer CSS Import Rule Use-after-free Vulnerability

Last Update Date: 28 Jan 2011 Release Date: 10 Dec 2010 4850 Views

RISK: Medium Risk

A vulnerability has been identified in Microsoft Internet Explorer, which could be exploited by remote attackers to take complete control of a vulnerable system. This issue is caused by a use-after-free error within the "mshtml.dll" library when processing a web page referencing a CSS (Cascading Style Sheets) file that includes various "@import" rules, which could allow remote attackers to execute arbitrary code via a specially crafted web page.

Impact

Remote Code Execution

System / Technologies affected

Microsoft Internet Explorer 8
Microsoft Internet Explorer 7
Microsoft Internet Explorer 6
Microsoft Windows 7
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Vista
Microsoft Windows Server 2003
Microsoft Windows XP

Solutions

It is not aware of any vendor-supplied patch.

Vulnerability Identifier

No CVE information is available

Source

VUPEN