A memory corruption flaw exists in Microsoft Internet Explorer. The program fails to sanitize user-supplied input when accessing a deleted object during the handling of VML files resulting in memory corruption. This may allow a remote attacker to execute arbitrary code.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability. Check the vendor advisory in the references section.

• Security Tracker: 1026677
• CVE ID: 2012-0155 (see also: NVD)
• Microsoft Knowledge Base Article: 2647516
• Secunia Advisory ID: 48028
• Bugtraq ID: 51935
• Related OSVDB ID: 79266 79267
• Mail List Post: http://seclists.org/bugtraq/2012/Feb/127
• Vendor Specific Advisory URL: http://technet.microsoft.com/en-us/security/bulletin/ms12-010
• Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-12-036

• Stephen Fewer - Zero Day Initiative (ZDI)