ID CVE-2012-4787
Summary Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "Improper Ref Counting Use After Free Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:*:*:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:*:*:x86:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:*:*:x86:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:*:sp1:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:*:sp1:x86:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:*:r2:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x86:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8:-:-:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_8:-:-:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8:-:-:x86:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_8:-:-:x86:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 12-10-2018 - 22:03)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
oval via4
accepted 2014-08-18T04:01:31.202-04:00
class vulnerability
contributors
  • name SecPod Team
    organization SecPod Technologies
  • name Pradeep R B
    organization SecPod Technologies
  • name Maria Mikhno
    organization ALTX-SOFT
definition_extensions
  • comment Microsoft Internet Explorer 9 is installed
    oval oval:org.mitre.oval:def:11985
  • comment Microsoft Windows 7 is installed
    oval oval:org.mitre.oval:def:12541
  • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
    oval oval:org.mitre.oval:def:6438
  • comment Microsoft Windows Vista (32-bit) is installed
    oval oval:org.mitre.oval:def:1282
  • comment Microsoft Windows Vista x64 Edition is installed
    oval oval:org.mitre.oval:def:2041
  • comment Microsoft Windows Server 2008 (32-bit) is installed
    oval oval:org.mitre.oval:def:4870
  • comment Microsoft Windows Server 2008 (64-bit) is installed
    oval oval:org.mitre.oval:def:5356
  • comment Microsoft Windows Server 2008 (ia-64) is installed
    oval oval:org.mitre.oval:def:5667
  • comment Microsoft Windows 7 (32-bit) is installed
    oval oval:org.mitre.oval:def:6165
  • comment Microsoft Windows 7 x64 Edition is installed
    oval oval:org.mitre.oval:def:5950
  • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
    oval oval:org.mitre.oval:def:5954
  • comment Microsoft Internet Explorer 10 is installed
    oval oval:org.mitre.oval:def:15751
  • comment Microsoft Windows 7 is installed
    oval oval:org.mitre.oval:def:12541
  • comment Microsoft Windows Server 2008 R2 x64 Edition is installed
    oval oval:org.mitre.oval:def:6438
  • comment Microsoft Windows 7 (32-bit) is installed
    oval oval:org.mitre.oval:def:6165
  • comment Microsoft Windows 7 x64 Edition is installed
    oval oval:org.mitre.oval:def:5950
  • comment Microsoft Windows Server 2008 R2 Itanium-Based Edition is installed
    oval oval:org.mitre.oval:def:5954
  • comment Microsoft Windows 8 is installed
    oval oval:org.mitre.oval:def:15732
  • comment Microsoft Windows Server 2012 is installed
    oval oval:org.mitre.oval:def:16359
description Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "Improper Ref Counting Use After Free Vulnerability."
family windows
id oval:org.mitre.oval:def:16211
status accepted
submitted 2012-12-12T10:50:10
title Improper Ref Counting Use After Free Vulnerability - MS12-077
version 73
refmap via4
cert TA12-346A
ms MS12-077
Last major update 12-10-2018 - 22:03
Published 12-12-2012 - 00:55
Back to Top