====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN328
____________________________________________________________________

DATE                :  16/08/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running Internet Explorer versions 6, 7,
                                      8, 9.

======================================================================
KB2722913
http://technet.microsoft.com/en-us/security/bulletin/MS12-052
______________________________________________________________________


Microsoft Security Bulletin MS12-052 - Critical Cumulative Security
Update for Internet Explorer (2722913)

Published Date: August 14, 2012

Version: 1.0

General Information


Executive Summary

This security update resolves four privately reported vulnerabilities in
Internet Explorer. The most severe vulnerabilities could allow remote
code execution if a user views a specially crafted webpage using
Internet Explorer.
An attacker who successfully exploited any of these vulnerabilities
could gain the same user rights as the current user. Users whose
accounts are configured to have fewer user rights on the system could be
less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6, Internet
Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows
clients and Moderate for Internet Explorer 6, Internet Explorer 7,
Internet Explorer 8, and Internet Explorer 9 on Windows servers. For
more information, see the subsection, Affected and Non-Affected
Software, in this section.


Affected Software

Internet Explorer 6
Internet Explorer 7
Internet Explorer 8
Internet Explorer 9
Windows XP Service Pack 3
Windows XP Professional x64 Edition Service Pack 2
Windows Server 2003 Service Pack 2
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1


Vulnerability Information

Layout Memory Corruption Vulnerability - CVE-2012-1526

A remote code execution vulnerability exists in the way that Internet
Explorer accesses an object that has not been correctly initialized or
has been deleted.
The vulnerability may corrupt memory in such a way that an attacker
could execute arbitrary code in the context of the current user.

Asynchronous NULL Object Access Remote Code Execution Vulnerability -
CVE-2012-2521

A remote code execution vulnerability exists in the way that Internet
Explorer accesses an object that has been deleted. The vulnerability may
corrupt memory in such a way that an attacker could execute arbitrary
code in the context of the current user.

Virtual Function Table Corruption Remote Code Execution Vulnerability -
CVE-2012-2522

A remote code execution vulnerability exists in the way that Internet
Explorer accesses a corrupted virtual function table that has been
deleted. The vulnerability may corrupt memory in such a way that an
attacker could execute arbitrary code in the context of the current user.


JavaScript Integer Overflow Remote Code Execution Vulnerability -
CVE-2012-2523
A remote code execution vulnerability exists in the way that Internet
Explorer calculates the size of an object in memory during a copy
operation. The vulnerability may corrupt memory in such a way that an
attacker could execute arbitrary code in the context of the current user.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================