CVE-2011-0346 : Use-after-free vulnerability in the ReleaseInterface function in MSHTML.DLL in M

Use-after-free vulnerability in the ReleaseInterface function in MSHTML.DLL in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the DOM implementation and the BreakAASpecial and BreakCircularMemoryReferences functions, as demonstrated by cross_fuzz, aka "MSHTML Memory Corruption Vulnerability."

Published 2011-01-07 23:00:20

Updated 2025-04-11 00:51:22

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute codeDenial of service

Products affected by CVE-2011-0346

Microsoft » Internet Explorer » Version: 6
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows 2003 Server » Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » Internet Explorer » Version: 7
cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2
When used together with: Microsoft » Windows 2003 Server » Update SP2 Itanium Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » Internet Explorer » Version: 8
cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2 Itanium Edition
When used together with: Microsoft » Windows 7
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition

Exploit prediction scoring system (EPSS) score for CVE-2011-0346

EPSS FAQ

55.94%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-0346

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-10-21
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2011-0346

CWE-399

Assigned by: nvd@nist.gov (Primary)
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2011-0346

http://www.securityfocus.com/bid/45639

Microsoft Internet Explorer 'ReleaseInterface()' Remote Code Execution Vulnerability
http://www.us-cert.gov/cas/techalerts/TA11-102A.html

Microsoft Updates for Multiple Vulnerabilities | CISA
US Government Resource

CVEs referencing this url
http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0698.html

CVEs referencing this url
http://www.securitytracker.com/id?1024940

Microsoft Internet Explorer Use-After-Free in 'mshtml.dll' May Let Remote Users Execute Arbitrary Code - SecurityTracker
http://lcamtuf.blogspot.com/2011/01/announcing-crossfuzz-potential-0-day-in.html

lcamtuf's blog: Announcing cross_fuzz, a potential 0-day in circulation, and more

CVEs referencing this url
http://www.vupen.com/english/advisories/2011/0026

Webmail | OVH- OVH
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/64482

Microsoft Internet Explorer ReleaseInterface() code execution CVE-2011-0346 Vulnerability Report
http://lcamtuf.coredump.cx/cross_fuzz/known_vuln.txt
http://www.securityfocus.com/archive/1/515506/100/0/threaded

SecurityFocus

CVEs referencing this url
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018

Microsoft Security Bulletin MS11-018 - Critical | Microsoft Docs

CVEs referencing this url
http://lcamtuf.coredump.cx/cross_fuzz/fuzzer_timeline.txt

CVEs referencing this url
http://www.kb.cert.org/vuls/id/427980

VU#427980 - Microsoft Internet Explorer 8 use-after-free vulnerability
US Government Resource
http://lcamtuf.coredump.cx/cross_fuzz/msie_crash.txt
http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

Assessing the risk of public issues currently being tracked by the MSRC – Microsoft Security Response Center

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11882

Repository / Oval Repository

Jump to

Vulnerability Details : CVE-2011-0346

Products affected by CVE-2011-0346

Exploit prediction scoring system (EPSS) score for CVE-2011-0346

CVSS scores for CVE-2011-0346

CWE ids for CVE-2011-0346

References for CVE-2011-0346