Vulnerability Bulletins |
Desbordamiento de búfer en Microsoft Windows Vector Markup Language |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | Microsoft |
| Affected software |
Microsoft Internet Explorer 5.01 SP4 Microsoft Internet Explorer 6 Microsoft Internet Explorer 6 SP1 Windows Internet Explorer 7 |
Description |
|
|
Se ha encontrado una vulnerabilidad del tipo desbordamiento de entero en Internet Explorer en las versiones 5.01, 6 y 7 en el componente Vector Markup Language. La vulnerabilidad reside en un error en el código de la clase CDownloadSink. Un atacante remoto podría ejecutar código arbitrario mediante un contenido comprimido con un tamaño de búfer no válido. El boletín MS08-052 sustituye al MS07-050. |
|
Solution |
|
|
Actualización de software Microsoft Internet Explorer 5.01 SP4 / Windows 2000 / patch IE5.01sp4-KB938127-Windows2000sp4-x86-enu Internet Explorer 6 SP1 / Windows 2000 / patch IE6.0sp1-KB938127-Windows2000-x86-enu Internet Explorer 6 / Windows XP SP2 / patch Windowsxp-kb938127-x86-enu Internet Explorer 7 / Windows XP SP2 / patch IE7-KB938127-WindowsXP-x86-enu Internet Explorer 6 / Windows Server 2003 / patch Windowsserver2003-kb938127-x86-enu Internet Explorer 7 / Windows Server 2003 / patch IE7-KB938127-WindowsServer2003-x86-enu Internet Explorer 7 / Windows Vista / patch Windows6.0-KB938127-x86.msu Internet Explorer 7 / Windows Vista (64 bit) / patch Windows6.0-KB938127-x64.msu |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2007-1749 |
| BID | 25310 |
Other resources |
|
|
Microsoft Security Bulletin (MS07-050) http://www.microsoft.com/technet/security/Bulletin/MS07-050.mspx Microsoft Security Bulletin (MS08-052) http://www.microsoft.com/technet/security/bulletin/ms08-052.mspx |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2007-08-16 |
| 1.1 | Aviso emitido por Microsoft (MS08-052) | 2008-09-10 |