Microsoft Internet Explorer CVE-2014-4082 Remote Memory Corruption Vulnerability

Bugtraq ID:	69585
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-4082
Remote:	Yes
Local:	No
Published:	Sep 09 2014 12:00AM
Updated:	Sep 09 2014 12:00AM
Credit:	Yuki Chen of Qihoo 360 and Bo Qu of Palo Alto Networks
Vulnerable:	Microsoft Internet Explorer 9 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 R2 for x64-based Systems SP1 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 Microsoft Internet Explorer 8 + Microsoft Windows 7 + Microsoft Windows 7 for 32-bit Systems SP1 + Microsoft Windows 7 for 32-bit Systems 0 + Microsoft Windows 7 for x64-based Systems SP1 + Microsoft Windows 7 for x64-based Systems 0 + Microsoft Windows 7 Home Premium 0 + Microsoft Windows 7 Home Premium - Sp1 X64 + Microsoft Windows 7 Home Premium - Sp1 X32 + Microsoft Windows Server 2008 R2 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2008 R2 SP1 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 R2 x64 SP1 + Microsoft Windows Server 2008 R2 x64 0 + Microsoft Windows Server 2008 Standard Edition X64 + Microsoft Windows Server 2008 Standard Edition SP2 + Microsoft Windows Server 2008 Standard Edition 0 + Microsoft Windows Server 2008 Standard Edition - Sp2 Web + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium SP2 + Microsoft Windows Vista Home Premium SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic SP2 + Microsoft Windows Vista Home Basic SP1 + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise SP2 + Microsoft Windows Vista Enterprise SP1 + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business SP2 + Microsoft Windows Vista Business SP1 + Microsoft Windows Vista 0 + Microsoft Windows Vista Business 64-bit edition SP2 + Microsoft Windows Vista Business 64-bit edition SP1 + Microsoft Windows Vista Business 64-bit edition 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition Sp2 X64 + Microsoft Windows Vista Home Basic 64-bit edition SP2 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows XP 0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP2 + Microsoft Windows XP Embedded SP1 + Microsoft Windows XP Embedded + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP1 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition Microsoft Internet Explorer 7.0 + Microsoft Windows Server 2003 Sp2 X64 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 SP2 + Microsoft Windows Server 2003 Sp1 X64 + Microsoft Windows Server 2003 SP1 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium 0 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems SP2 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for 32-bit Systems 0 + Microsoft Windows Server 2008 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 for Itanium-based Systems SP2 + Microsoft Windows Server 2008 for Itanium-based Systems 0 + Microsoft Windows Server 2008 for Itanium-based Systems 0 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems SP2 + Microsoft Windows Server 2008 for x64-based Systems R2 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Server 2008 for x64-based Systems 0 + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista Ultimate + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP2 + Microsoft Windows Vista SP1 + Microsoft Windows Vista SP1 + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Premium + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Home Basic + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Enterprise + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista Business + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista 0 + Microsoft Windows Vista Enterprise 64-bit edition SP2 + Microsoft Windows Vista Enterprise 64-bit edition SP1 + Microsoft Windows Vista Enterprise 64-bit edition 0 + Microsoft Windows Vista Home Basic 64-bit edition Sp1 X64 + Microsoft Windows Vista Home Basic 64-bit edition SP1 + Microsoft Windows Vista Home Basic 64-bit edition 0 + Microsoft Windows Vista Home Premium 64-bit edition SP2 + Microsoft Windows Vista Home Premium 64-bit edition SP1 + Microsoft Windows Vista Home Premium 64-bit edition 0 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP2 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition SP1 + Microsoft Windows Vista x64 Edition 0 + Microsoft Windows Vista x64 Edition 0 + Microsoft Windows XP 0 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Embedded SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP3 + Microsoft Windows XP Home SP2 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Media Center Edition SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP3 + Microsoft Windows XP Professional SP2 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP3 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition + Microsoft Windows XP Service Pack 3 0 + Microsoft Windows XP Tablet PC Edition SP3 + Microsoft Windows XP Tablet PC Edition SP3 Microsoft Internet Explorer 6.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP2 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services SP1 - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 2000 Terminal Services - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Terminal Server 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6a + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional
Not Vulnerable:

Microsoft Internet Explorer CVE-2014-4082 Remote Memory Corruption Vulnerability

Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage.

Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions.

Internet Explorer 6, 7, 8, 9 and 10 are vulnerable.

Microsoft Internet Explorer CVE-2014-4082 Remote Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Internet Explorer 10

• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 7 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=25b9735d-9df0 -477b-a34f-90c62d2f9c33


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 7 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=0062d37f-5dc4 -44e5-994a-0ac37358fd7b


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 8 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6dd6cf43-aa7f -48e8-ada3-053e1cfaac70


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows 8 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6e9de779-07ec -480f-bd66-062ae8564d2b


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows Server 2008 R2 x64 Edition (KB2977629
  http://www.microsoft.com/downloads/details.aspx?FamilyID=d050a400-d503 -49e8-9033-81b452060d7c


• Microsoft Cumulative Security Update for Internet Explorer 10 in Windows Server 2012 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=2f600cfb-9abb -498f-9504-e3b5ac9cf540

Microsoft Internet Explorer 7.0

• Microsoft Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=3dd813bd-11da -4d9c-b09d-b5236f9fe2e1


• Microsoft Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 64-bit Itanium Edition (K
  http://www.microsoft.com/downloads/details.aspx?FamilyID=20a530f2-7dfc -4996-8f7e-1b7c07bf207b


• Microsoft Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=a90838a2-6cfe -42fc-87df-8633b747c5d9


• Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Server 2008 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=434d834c-6482 -4917-b30b-a2a2d58eb9b8


• Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Server 2008 for Itanium-based Systems
  http://www.microsoft.com/downloads/details.aspx?FamilyID=9e08e823-0b81 -40e5-8280-9d4aacfe27b7


• Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Server 2008 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=d2d3cda3-e627 -4ceb-8634-7ce8a80f1857


• Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Vista (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=e5988001-d093 -47e7-bd19-be5160f91b83


• Microsoft Cumulative Security Update for Internet Explorer 7 in Windows Vista x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=75e51906-8ad7 -44c2-a750-cf53bea2bd33

Microsoft Internet Explorer 8

• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=1611d668-d05b -472b-b321-e9c01ffb0c16


• Microsoft Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=d80d93bf-eb0b -47fe-a7e7-e0c946b58c83


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows 7 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=44d00724-84b0 -4def-a7c6-315fc17736e9


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows 7 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=13fafec5-880f -47fe-9adf-7a76e319f84d


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=c7ec208a-2c89 -446b-a96a-e0bcb0b9c039


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 R2 for Itanium-based Syste
  http://www.microsoft.com/downloads/details.aspx?FamilyID=760dae91-e0f4 -407c-aea6-cb7b8d7dbae8


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 R2 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=44d22214-9549 -4d47-950a-b7d4d30d2473


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Server 2008 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=3e594f5d-7bcb -46f1-8eb6-a3ded46557c9


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Vista (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=9b30e101-0d4f -4e37-9766-145f19534c2f


• Microsoft Cumulative Security Update for Internet Explorer 8 in Windows Vista x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=8a11242b-fbba -4df4-b58d-ddb2f0a7394c

Microsoft Internet Explorer 6.0

• Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=73ca72ba-6660 -407b-906a-f73cf69a4afc


• Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 64-bit Itanium Edition (KB2
  http://www.microsoft.com/downloads/details.aspx?FamilyID=0b7af14e-e8b8 -459e-9f6e-98c646507313


• Microsoft Cumulative Security Update for Internet Explorer for Windows Server 2003 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=edc7f51c-6c68 -4c89-a29a-c408eee95019

Microsoft Internet Explorer 9

• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows 7 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=dc7f0d67-dd86 -4ada-931a-395ed4f13400


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows 7 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=392340b1-6c1c -4247-b7a7-ac9ab5a8f5d2


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=020726bf-56d7 -43c1-9f42-4e84196a1132


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 R2 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=b228262c-50ae -4dba-9cfa-5b2d36aef45f


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Server 2008 x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=6ca9a876-cf8f -4cdf-8f97-3e1e1dcaf555


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Vista (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=dbe758a7-b720 -4155-9bee-04aad0343d6e


• Microsoft Cumulative Security Update for Internet Explorer 9 in Windows Vista x64 Edition (KB2977629)
  http://www.microsoft.com/downloads/details.aspx?FamilyID=e5af2769-859d -4f68-8bb7-9977293cbcf4