Rewindex/CVEs

CVE-2014-1776: Microsoft Internet Explorer Memory Corruption Vulnerability

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Microsoft: Internet Explorer

References

• CVE record on cve.org (opens in new tab)
• NVD entry (opens in new tab)
• blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advis… (opens in new tab)
• docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-021 (opens in new tab)
• secunia.com/advisories/57908 (opens in new tab)
• securitytracker.com/id (opens in new tab)
• technet.microsoft.com/library/security/2963983 (opens in new tab)
• www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-ex… (opens in new tab)
• www.kb.cert.org/vuls/id/222929 (opens in new tab)
• www.osvdb.org/106311 (opens in new tab)
• www.securityfocus.com/bid/67075 (opens in new tab)
• www.signalsec.com/cve-2014-1776-ie-0day-analysis/ (opens in new tab)

All CVEsMarkdownJSON

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)