CVE-2009-3019: Microsoft Internet Explorer

Medium severity, CVSS 5.0. EPSS: 17.4% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute to set the value attribute.

Affected products

• Microsoft Internet Explorer: version 6 only; version 7 only

Published 2009-08-31. Last modified 2026-06-16.