CVE-2016-0072: Microsoft IE SVGAnimatedAngle Use-After-Free RCE Vulnerability

Critical Vulnerability Information Vulnerability Overview - Title: Microsoft Internet Explorer SVGAnimatedAngle Use-After-Free Remote Code Execution Vulnerability - Date: February 9th, 2016 - Identifiers: - ZDI-16-157 - ZDI-CAN-3297 - CVE ID: CVE-2016-0072 Vulnerability Rating - CVSS Score: 6.8 - CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Affected Information - Vendor: Microsoft - Product: Internet Explorer Vulnerability Details - Description: Remote attackers can exploit this vulnerability to execute arbitrary code on a vulnerable Microsoft Internet Explorer installation. User interaction is required, as the target must access a malicious page or open a malicious file. The vulnerability exists in the handling of SVGAnimatedAngle objects. By manipulating document elements, an attacker can cause the reuse of an SVGAnimatedAngle object in freed memory, leading to arbitrary code execution within the context of the current process. Remediation - Details: Microsoft has released an update to fix this vulnerability. For more information, please refer to: https://technet.microsoft.com/en-us/library/security/MS16-009 Disclosure Timeline - Report Date: 2015-09-17 - Vulnerability reported to vendor - Public Release Date: 2016-02-09 - Coordinated public announcement released Other - Contributor Credit: 0016EECD9D7159A949DAD3BC17E0A939 - Customer Protection: Trend Micro’s TippingPoint IPS customers are protected against this vulnerability via Digital Vaccine filter ID ['20998']. For more information on TippingPoint IPS, visit: http://www.tippingpoint.com

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2016-0072: Microsoft IE SVGAnimatedAngle Use-After-Free RCE Vulnerability