====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN460
____________________________________________________________________

DATE                :  14/11/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running Internet Explorer version 9.

======================================================================
KB2761451
http://technet.microsoft.com/en-us/security/bulletin/ms12-071
______________________________________________________________________

Microsoft Security Bulletin MS12-071 - Critical
Cumulative Security Update for Internet Explorer (2761451)

Published Date: November 13, 2012

Version: 1.0

General Information


Executive Summary

This security update resolves three privately reported vulnerabilities
in Internet Explorer. The vulnerabilities could allow remote code
execution if a user views a specially crafted webpage using Internet
Explorer. An attacker who successfully exploited these vulnerabilities
could gain the same user rights as the current user. Users whose
accounts are configured to have fewer user rights on the system could
be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 9 on
Windows clients and Moderate for Internet Explorer 9 on Windows
servers.


Affected Software

Internet Explorer 9


Vulnerability Information

CFormElement Use After Free Vulnerability - CVE-2012-1538

A remote code execution vulnerability exists in the way that Internet
Explorer accesses an object that has not been correctly initialized or
has been deleted.
The vulnerability may corrupt memory in such a way that an attacker
could execute arbitrary code in the context of the current user.

CTreePos Use After Free Vulnerability - CVE-2012-1539

A remote code execution vulnerability exists in the way that Internet
Explorer accesses an object that has not been correctly initialized or
has been deleted.
The vulnerability may corrupt memory in such a way that an attacker
could execute arbitrary code in the context of the current user.

CTreeNode Use After Free Vulnerability - CVE-2012-4775

A remote code execution vulnerability exists in the way that Internet
Explorer accesses an object that has not been correctly initialized or
has been deleted.
The vulnerability may corrupt memory in such a way that an attacker
could execute arbitrary code in the context of the current user.


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================