CVE-2007-3902 Use after free in n/a
Remote attackers can execute arbitrary code in Internet Explorer by exploiting a use-after-free flaw via specific HTML manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2007-3902?
CVE-2007-3902 is a critical use after free vulnerability in Microsoft Ie, published on 12 Dec 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code by calling the setExpression method and then modifying the outerHTML property of an HTML element, one variant of "Uninitialized Memory Corruption Vulnerability."
Which versions are affected by CVE-2007-3902?
It affects 2 products.
Products include Microsoft Ie, Microsoft Internet Explorer.
How do I fix CVE-2007-3902?
No fix has been published for CVE-2007-3902 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2007-3902 being exploited?
There is no known exploitation of CVE-2007-3902 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Ie
Sources
Also known as GHSA-27m8-q4mw-5g3g.