CVE-2010-0249Microsoft Internet Explorer Use-After-Free Vulnerability
Explotación conocida — Microsoft Internet Explorer Use-After-Free Vulnerability
CISA confirmó el 20.05.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 03.06.2026.
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249
Descripción
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| microsoft | internet explorer | 5.0.1 |
Referencias y parches
- http://www.microsoft.com/technet/security/advisory/979352.mspx Broken LinkPatchVendor Advisory
- oval:org.mitre.oval:def:6835 vdb-entrysignatureBroken Link
- 61697 vdb-entryBroken Link
- 37815 vdb-entryBroken LinkExploitThird Party Advisory
- VU#492515 third-party-advisoryThird Party AdvisoryUS Government Resource
- 11167 exploitExploitThird Party AdvisoryVDB Entry
- 979352 vendor-advisoryPatchVendor Advisory
- http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx Broken LinkVendor Advisory
- ie-freed-object-code-execution(55642) vdb-entryThird Party AdvisoryVDB Entry
- TA10-055A third-party-advisoryBroken LinkThird Party AdvisoryUS Government Resource
- MS10-002 vendor-advisoryPatchVendor Advisory
- http://news.cnet.com/8301-27080_3-10435232-245.html Broken Link
- 1023462 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- ADV-2010-0135 vdb-entryBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0249 US Government Resource
Coincidencias CPE (NVD) (5)
cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*