CVE-2014-1776

Description

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."

CVSS 3.1 breakdown

Affected products

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advisory-2963983-ie-0day.aspxBroken LinkMitigation
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-021PatchVendor Advisory
• http://secunia.com/advisories/57908Broken Link
• http://securitytracker.com/id?1030154Broken LinkThird Party AdvisoryVDB Entry
• https://technet.microsoft.com/library/security/2963983MitigationPatchVendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1776US Government Resource
• https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explorer-detection-scriptThird Party Advisory
• https://www.vicarius.io/vsociety/posts/cve-2014-1776-use-after-free-vulnerability-in-microsoft-internet-explorer-mitigation-scriptsThird Party Advisory
• http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.htmlBroken Link
• http://www.kb.cert.org/vuls/id/222929MitigationThird Party AdvisoryUS Government Resource

and 3 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked