rapid7/metasploit-framework — pull request #795 by wchen-r7 (2012-09-17 13:34:04+00:00)
Title: Add IE 0day exploiting the execcommand uaf

This module exploits a vulnerability found in Microsoft Internet Explorer. When
rendering an HTML page, the CMshtmlEd object gets deleted in an unexpectedly matter,
but the same memory is reused again later in a CMshtmlEd::Exec() function, which
causes an use-after-free condition. Please note that this vulnerability has
been exploited in the wild since Sep 14th 2012, and there is currently no official
patch to it.