Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.

Unpatched versions of Internet Explorer 6 through 11 contain a vulnerability that bypasses both of Windows' ASLP and DEP protections, though current attacks in the wild have been targeting versions 9 and onward. An attacker could leverage this to execute arbitrary code within the context of the user running the browser. 

The remote host is missing Internet Explorer (IE) Security Update 2925418.

The installed version of IE is affected by multiple privilege escalation and memory corruption vulnerabilities that could allow an attacker to execute arbitrary code on the remote host. Additionally, the installed version of IE is affected by an information disclosure vulnerability.

ID	Name	Product	Family	Severity
8240	Microsoft Internet Explorer 6 through 11 Arbitrary Code Execution	Nessus Network Monitor	Web Clients	high
72930	MS14-012: Cumulative Security Update for Internet Explorer (2925418)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2014-0322

high

Tenable Plugins

high

high