CVE-2010-3962Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Bekannt ausgenutzt — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
CISA hat am 06.10.2025 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 27.10.2025.
Erforderliche Maßnahme: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ; https://nvd.nist.gov/vuln/detail/CVE-2010-3962
Beschreibung
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Referenzen und Patches
- 44536 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- TA10-348A third-party-advisoryThird Party AdvisoryUS Government Resource
- MS10-090 vendor-advisoryPatchVendor Advisory
- VU#899748 third-party-advisoryThird Party AdvisoryUS Government Resource
- 42091 third-party-advisoryBroken LinkVendor Advisory
- ADV-2010-2880 vdb-entryBroken LinkVendor Advisory
- http://www.microsoft.com/technet/security/advisory/2458511.mspx PatchVendor Advisory
- 1024676 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 15421 exploitThird Party AdvisoryVDB Entry
- http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Not Applicable
- ms-ie-flag-code-execution(62962) vdb-entryThird Party AdvisoryVDB Entry
- http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Vendor Advisory
- oval:org.mitre.oval:def:12279 vdb-entrysignatureTool Signature
- 15418 exploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962 US Government Resource
CPE-Treffer (NVD) (3)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*