CVE-2008-3475

HIGH 8.8CVE-2008-3475 · Published 15/10/2008 · updated 16/06/2026

Package	Affected versions	Patched versions
internet explorer microsoft	`= 5.01= 6= 7.0`	No fix yet

Description

Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."

References

ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html · Issue Tracking
marc.info · Mailing List
securityfocus.com/archive/1/497380/100/0/threaded · Broken Link
securityfocus.com/bid/31617 · Broken Link
securitytracker.com/id · Broken Link
us-cert.gov/cas/techalerts/TA08-288A.html · Broken Link
vupen.com/english/advisories/2008/2809 · Broken Link
zerodayinitiative.com/advisories/ZDI-08-069 · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058 · Patch
exchange.xforce.ibmcloud.com/vulnerabilities/45563 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/45565 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13151 · Broken Link

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free