Microsoft Internet Explorer (IE) does not safely reference CSS style elements. Using a specially crafted HTML page, an attacker can cause IE to crash and potentially execute arbitrary code.
IE contains a vulnerability in the way it references CSS style elements. Processing a specially crafted HTML page could cause IE to access an invalid memory location and crash. Using heap-spraying techniques, an attacker could leverage the crash to execute arbitrary code.
Please see Microsoft Security Advisory (977981).
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message), an attacker could execute arbitrary code with the privileges of the user.
A complete solution is not available.
Disable Active scripting
This vulnerability was publicly disclosed by email@example.com and/or K4mr4n_st@yahoo.com.
This document was written by Art Manion.
|Date First Published:||2009-11-25|
|Date Last Updated:||2009-11-27 19:09 UTC|