MS12-037  Cumulative Security Update for Internet Explorer

2012-06-12 This security update resolves one publicly disclosed and twelve privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Vulnerabilities addressed in this bulletin:

HTML Sanitization Vulnerability

An information disclosure vulnerability exists in the way that Internet Explorer handles content using specific strings when sanitizing HTML. An attacker could exploit the vulnerability by constructing a specially crafted Web page that could allow information disclosure if a user viewed the Web page. An attacker who successfully exploited this vulnerability could inflict cross-site scripting on the user, allowing the attacker to execute script in the user's security context against a site that is using the toStaticHTML method.
CVE-2012-1858

EUC-JP Character Encoding Vulnerability

An information disclosure vulnerability exists in Internet Explorer that could allow script to perform Cross-Site Scripting attacks. An attacker could exploit the vulnerability by inserting specially crafted strings in to a website, resulting in information disclosure when a user viewed the website.
CVE-2012-1872

Null Byte Information Disclosure Vulnerability

An information disclosure vulnerability exists in Internet Explorer that could allow an attacker to gain access and read Internet Explorer's process memory. An attacker could exploit the vulnerability by constructing a specially crafted webpage that could allow information disclosure if a user viewed the webpage. An attacker who successfully exploited this vulnerability could view content from Internet Explorer's process memory.
CVE-2012-1873

Developer Toolbar Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1874

Same ID Property Remote Code Execution Vulnerability

remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1875

Center Element Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1523

Col Element Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that does not exist. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1876

Title Element Change Remote Code Execution Vulneraiblity

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1877

OnBeforeDeactivate Event Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1878

insertAdjacentText Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an undefined memory location. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1879

insertRow Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1880

OnRowsInserted Event Remote Code Execution Vulneraiblity

A remote code execution vulnerability exists in the way that Internet Explorer accesses an object that has been deleted. The vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
CVE-2012-1881

Scrolling Events Information Disclosure Vulnerability

An information disclosure vulnerability exists in Internet Explorer that could allow an attacker to gain access to information in another domain or Internet Explorer zone. An attacker could exploit the vulnerability by constructing a specially crafted webpage that could allow information disclosure if a user viewed the webpage. An attacker who successfully exploited this vulnerability could view content from another domain or Internet Explorer zone.
CVE-2012-1882

Bulletin details at Microsoft.com