CVE-2011-1260 : Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory,

Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability."

Published 2011-06-16 20:55:02

Updated 2023-12-07 18:38:57

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionExecute code

Products affected by CVE-2011-1260

Microsoft » Internet Explorer » Version: 8
cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2 Itanium Edition
When used together with: Microsoft » Windows 7
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X32 Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 Itanium Edition
When used together with: Microsoft » Windows Server 2008 » Update R2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2 Itanium Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Xp » Update SP3
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 X64 Edition
Microsoft » Internet Explorer » Version: 9
cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X64 Edition
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1 X86 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X32 Edition
When used together with: Microsoft » Windows Server 2008 » Update SP2 X64 Edition
When used together with: Microsoft » Windows Server 2008 » Version: R2 X64 Edition
When used together with: Microsoft » Windows Vista » Update SP2

Exploit prediction scoring system (EPSS) score for CVE-2011-1260

EPSS FAQ

97.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2011-1260

MS11-050 IE mshtml!CObjectElement Use After Free

Disclosure Date: 2011-06-16

First seen: 2020-04-26

exploit/windows/browser/ms11_050_mshtml_cobjectelement

This module exploits a use-after-free vulnerability in Internet Explorer. The vulnerability occurs when an invalid <object> tag exists and other elements overlap/cover where the object tag should be when rendered (due to their styles/positioning). The mshtml!CObjec

More information

CVSS scores for CVE-2011-1260

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2011-1260

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1260

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-050

Microsoft Security Bulletin MS11-050 - Critical | Microsoft Docs

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12308

Repository / Oval Repository
http://securityreason.com/securityalert/8275

IE mshtml!CObjectElement Use After Free (MS11-050) - CXSecurity.com

Jump to