====================================================================

                                 CERT-Renater

                       Note d'Information No. 2012/VULN172
____________________________________________________________________

DATE                : 11/04/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running Internet Explorer versions 6, 7, 8, 9.

======================================================================
KB2675157
http://technet.microsoft.com/en-us/security/bulletin/ms12-023
______________________________________________________________________

Microsoft Security Bulletin MS12-023 - Critical Cumulative Security
Update for Internet Explorer (2675157)

Published Date: April 10, 2012

Version: 1.0

General Information

Executive Summary

This security update resolves five privately reported vulnerabilities in
Internet Explorer. The most severe vulnerabilities could allow remote code
execution if a user views a specially crafted webpage using Internet Explorer.
An attacker who successfully exploited any of these vulnerabilities could gain
the same user rights as the current user. Users whose accounts are configured
to have fewer user rights on the system could be less impacted than users who
operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6, Internet
Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows clients
and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8,
and Internet Explorer 9 on Windows servers.

Affected Software

Internet Explorer 6
Internet Explorer 7
Internet Explorer 8
Internet Explorer 9

Vulnerability Information

Print Feature Remote Code Execution Vulnerability - CVE-2012-0168

A remote code execution vulnerability exists when Internet Explorer attempts to
print a specially crafted HTML page. The vulnerability could allow an attacker
to execute arbitrary code in the context of the current user.

JScript9 Remote Code Execution Vulnerability - CVE-2012-0169

A remote code execution vulnerability exists in the way that Internet Explorer
accesses an object that has been deleted. The vulnerability may corrupt memory
in such a way that an attacker could execute arbitrary code in the context of
the current user.

OnReadyStateChange Remote Code Execution Vulnerability - CVE-2012-0170

A remote code execution vulnerability exists in the way that Internet Explorer
accesses an object that has been deleted. The vulnerability may corrupt memory
in such a way that an attacker could execute arbitrary code in the context of
the current user.

SelectAll Remote Code Execution Vulnerability - CVE-2012-0171
A remote code execution vulnerability exists in the way that Internet Explorer
accesses an object that has been deleted. The vulnerability may corrupt memory
in such a way that an attacker could execute arbitrary code in the context of
the current user.

VML Style Remote Code Execution Vulnerability - CVE-2012-0172

A remote code execution vulnerability exists in the way that Internet Explorer
accesses an object that has been deleted. The vulnerability may corrupt memory
in such a way that an attacker could execute arbitrary code in the context of
the current user.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================