Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-1918 | First vendor Publication | 2009-07-29 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 do not properly handle table operations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption by adding malformed elements to an empty DIV element, related to the getElementsByTagName method, aka "HTML Objects Memory Corruption Vulnerability." |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1918 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:5524 | |||
| Oval ID: | oval:org.mitre.oval:def:5524 | ||
| Title: | HTML Objects Memory Corruption Vulnerability | ||
| Description: | Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 do not properly handle table operations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption by adding malformed elements to an empty DIV element, related to the getElementsByTagName method, aka "HTML Objects Memory Corruption Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2009-1918 | Version: | 7 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 | Product(s): | Microsoft Internet Explorer |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 5 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-07-29 | Name : Cumulative Security Update for Internet Explorer (972260) File : nvt/secpod_ms09-034.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 56694 | Microsoft IE Invalid HTML Object Element Appendage Handling Memory Corruption |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | Microsoft Internet Explorer empty table tag memory corruption attempt RuleID : 19814 - Revision : 9 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer empty table tag memory corruption attempt RuleID : 15733 - Revision : 9 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer CSS handling memory corruption attempt RuleID : 15732 - Revision : 12 - Type : BROWSER-IE |
| 2014-01-10 | Microsoft Internet Explorer javascript deleted reference arbitrary code execu... RuleID : 15731 - Revision : 16 - Type : BROWSER-IE |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-10-14 | Name : Arbitrary code can be executed on the remote host through Microsoft Office Ac... File : smb_nt_ms09-060.nasl - Type : ACT_GATHER_INFO |
| 2009-07-28 | Name : Arbitrary code can be executed on the remote host through a web browser. File : smb_nt_ms09-034.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:10:47 |
|
| 2024-11-28 12:19:08 |
|
| 2023-12-07 21:28:05 |
|
| 2021-07-27 00:24:33 |
|
| 2021-07-24 01:44:10 |
|
| 2021-07-24 01:06:11 |
|
| 2021-07-23 21:25:00 |
|
| 2021-07-23 17:24:37 |
|
| 2020-05-23 00:23:53 |
|
| 2019-02-26 17:19:31 |
|
| 2018-10-31 00:19:57 |
|
| 2018-10-13 00:22:49 |
|
| 2018-10-11 00:19:37 |
|
| 2017-09-29 09:24:15 |
|
| 2016-09-30 01:02:05 |
|
| 2016-08-31 12:01:48 |
|
| 2016-06-29 00:05:46 |
|
| 2016-04-26 18:52:29 |
|
| 2014-02-17 10:50:21 |
|
| 2014-01-19 21:25:56 |
|
| 2013-05-10 23:51:48 |
|
