{"id":"CVE-2008-3475","aliases":["EUVD-2008-3461","GHSA-hj95-cvvq-rc83"],"status":"published","title":"Microsoft Internet Explorer 6 does not properly handle errors related to using the...","description":"Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"Uninitialized Memory Corruption Vulnerability.\"","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.39864,"percentile":0.98634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-908"],"published":"2008-10-15T00:00:00Z","modified":"2026-06-16T22:55:53Z","products":[{"vendor":"microsoft","product":"internet_explorer"}],"references":[{"url":"http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13151","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Broken Link"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45563","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/497380/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058","tags":["vendor-advisory","x_refsource_MS","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/2809","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link"]},{"url":"http://www.securitytracker.com/id?1021047","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-069/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-288A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Broken Link","Third Party Advisory","US Government Resource"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45565","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/31617","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Patch","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-3475"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-08-069"},{"url":"https://github.com/advisories/GHSA-hj95-cvvq-rc83"}],"sources":{"cve":[{"id":"CVE-2008-3475","description":"Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"Uninitialized Memory Corruption Vulnerability.\"","status":"published","published":"2008-10-15T00:00:00Z","modified":"2024-08-07T09:37:27.036Z","updated_at":"2026-11-02T14:34:45.504702Z"}],"euvd":[{"id":"EUVD-2008-3461","description":"Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"Uninitialized Memory Corruption Vulnerability.\"","status":"published","published":"2008-10-15T00:00:00Z","modified":"2024-08-07T09:37:27Z","updated_at":"2026-11-03T01:38:52.249298Z"}],"ghsa":[{"id":"GHSA-hj95-cvvq-rc83","title":"Microsoft Internet Explorer 6 does not properly handle errors related to using the...","description":"Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"Uninitialized Memory Corruption Vulnerability.\"","status":"published","published":"2022-05-02T00:00:32Z","modified":"2025-04-09T04:00:29Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:00:58.538673Z"}],"nvd":[{"id":"CVE-2008-3475","description":"Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"Uninitialized Memory Corruption Vulnerability.\"","status":"published","published":"2008-10-15T00:12:15.833Z","modified":"2026-06-16T22:55:53.663Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:01:29.223028Z"}]}}