Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-0075 — Code Injection in Microsoft Internet Explorer

CWE-399CWE-94 — Code Injection20 documents6 sources
Severity
9.3CRITICALNVD
EPSS
86.9%
top 0.56%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Internet Explorer
Timeline
PublishedFeb 10
Latest updateMay 2

Description

Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to CFunctionPointer and the appending of document objects, aka "Uninitialized Memory Corruption Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-wmm4-42gq-5r23: Safari on Apple iPhone OS 3↗2022-05-02
▶
GHSA
GHSA-84pr-v9rf-j48h: Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to execute arb↗2022-05-02
▶
VulnCheck
Microsoft Internet Explorer 7 Uninitialized Memory Corruption Vulnerability↗2009
▶

💥Exploits & PoCs

7
Exploit-DB
Microsoft Internet Explorer 7 - CFunctionPointer Uninitialized Memory Corruption (MS09-002) (Metasploit)↗2010-07-12
▶
Exploit-DB
Microsoft Internet Explorer 7 - Memory Corruption (MS09-002)↗2009-03-04
▶
Exploit-DB
Microsoft Internet Explorer 7 (Windows XP SP2) - Memory Corruption (MS09-002)↗2009-02-20
▶
Exploit-DB
Microsoft Internet Explorer 7 (Windows 2003 SP2) - Memory Corruption (MS09-002)↗2009-02-20
▶
Exploit-DB
Microsoft Internet Explorer 7 - Memory Corruption (MS09-002)↗2009-02-20
▶

🕵️Threat Intelligence

8
Unit42
Web-Based Threats: First Half 2019↗2019-11-01
▶
Unit42
Web-Based Threats: First Half 2019↗2019-11-01
▶
Unit42
Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip↗2018-12-27
▶
Unit42
Web-based Threats-2018 Q3: Malicious URLs and Domains take a Dip↗2018-12-27
▶
Unit42
Web-based Threats-2018 Q2: U.S. Remains #1 in Malicious Web Addresses, China Falls from #2 to #7↗2018-09-05
▶
CVE-2009-0075 — Code Injection in Microsoft | cvebase