CVE-2012-1889
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Analysis
Microsoft XML Core Services 3.0 through 6.0 access uninitialized memory locations, allowing remote attackers to execute code or cause memory corruption through a crafted website, actively exploited before patch availability.
Technical Context
The CWE-787 vulnerability occurs when MSXML fails to properly initialize memory locations before use during XML document parsing. Attackers can trigger the uninitialized memory access through a crafted webpage, allowing them to control the contents of the uninitialized memory to achieve code execution.
Affected Products
['Microsoft XML Core Services 3.0', 'Microsoft XML Core Services 4.0', 'Microsoft XML Core Services 5.0', 'Microsoft XML Core Services 6.0']
Remediation
Apply Microsoft security update MS12-043. The underlying MSXML components are system libraries, so Windows Update is the correct remediation path.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today