ByteOS Network

CVE Vulnerability Details :

CVE-2012-4792

PUBLISHED

More Info Official Page

Assigner-microsoft

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

View Known Exploited Vulnerability (KEV) details

Published At-30 Dec, 2012 | 18:00

Updated At-22 Oct, 2025 | 00:05

▼CVE Numbering Authority (CNA)

Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.us-cert.gov/cas/techalerts/TA13-008A.html	third-party-advisory x_refsource_CERT
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008	vendor-advisory x_refsource_MS
http://www.kb.cert.org/vuls/id/154201	third-party-advisory x_refsource_CERT-VN
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb	x_refsource_MISC
http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/	x_refsource_MISC
http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.html	x_refsource_MISC
http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/	x_refsource_MISC
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361	vdb-entry signature x_refsource_OVAL
http://www.us-cert.gov/cas/techalerts/TA13-015A.html	third-party-advisory x_refsource_CERT
http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html	x_refsource_MISC
http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx	x_refsource_CONFIRM
http://technet.microsoft.com/security/advisory/2794220	x_refsource_CONFIRM
http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx	x_refsource_CONFIRM

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA13-008A.html

Resource:

third-party-advisory

x_refsource_CERT

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: http://www.kb.cert.org/vuls/id/154201

Resource:

third-party-advisory

x_refsource_CERT-VN

Hyperlink: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb

Resource:

x_refsource_MISC

Hyperlink: http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/

Resource:

x_refsource_MISC

Hyperlink: http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.html

Resource:

x_refsource_MISC

Hyperlink: http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/

Resource:

x_refsource_MISC

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA13-015A.html

Resource:

third-party-advisory

x_refsource_CERT

Hyperlink: http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html

Resource:

x_refsource_MISC

Hyperlink: http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx

Resource:

x_refsource_CONFIRM

Hyperlink: http://technet.microsoft.com/security/advisory/2794220

Resource:

x_refsource_CONFIRM

Hyperlink: http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

1. CISA ADP Vulnrichment

Affected Products

Vendor

Microsoft Corporation

Product

CPEs

cpe:2.3:a:microsoft:ie:6.0:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

From 6.0 through 8.0 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-416	CWE-416 Use After Free

Type: CWE

CWE ID: CWE-416

Description: CWE-416 Use After Free

Metrics

Version	Base score	Base severity	Vector
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2024-07-23

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792

Timeline

Event	Date
CVE-2012-4792 added to CISA KEV	2024-07-23 00:00:00

Event: CVE-2012-4792 added to CISA KEV

Date: 2024-07-23 00:00:00

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792	government-resource

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4792

Resource:

government-resource

2. CVE Program Container

References

Hyperlink	Resource
http://www.us-cert.gov/cas/techalerts/TA13-008A.html	third-party-advisory x_refsource_CERT x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008	vendor-advisory x_refsource_MS x_transferred
http://www.kb.cert.org/vuls/id/154201	third-party-advisory x_refsource_CERT-VN x_transferred
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb	x_refsource_MISC x_transferred
http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/	x_refsource_MISC x_transferred
http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.html	x_refsource_MISC x_transferred
http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/	x_refsource_MISC x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361	vdb-entry signature x_refsource_OVAL x_transferred
http://www.us-cert.gov/cas/techalerts/TA13-015A.html	third-party-advisory x_refsource_CERT x_transferred
http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html	x_refsource_MISC x_transferred
http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx	x_refsource_CONFIRM x_transferred
http://technet.microsoft.com/security/advisory/2794220	x_refsource_CONFIRM x_transferred
http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA13-008A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-008

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: http://www.kb.cert.org/vuls/id/154201

Resource:

third-party-advisory

x_refsource_CERT-VN

x_transferred

Hyperlink: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ie_cbutton_uaf.rb

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://labs.alienvault.com/labs/index.php/2012/just-another-water-hole-campaign-using-an-internet-explorer-0day/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://packetstormsecurity.com/files/119168/Microsoft-Internet-Explorer-CDwnBindInfo-Object-Use-After-Free.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16361

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA13-015A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

Hyperlink: http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://technet.microsoft.com/security/advisory/2794220

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://blogs.technet.com/b/srd/archive/2012/12/31/microsoft-quot-fix-it-quot-available-for-internet-explorer-6-7-and-8.aspx

Resource:

x_refsource_CONFIRM

x_transferred

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References