CVE-2010-3962Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Aktif olarak istismar ediliyor — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 06.10.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 27.10.2025.
Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN ; https://nvd.nist.gov/vuln/detail/CVE-2010-3962
Açıklama
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Kaynaklar ve yamalar
- 44536 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- TA10-348A third-party-advisoryThird Party AdvisoryUS Government Resource
- MS10-090 vendor-advisoryPatchVendor Advisory
- VU#899748 third-party-advisoryThird Party AdvisoryUS Government Resource
- 42091 third-party-advisoryBroken LinkVendor Advisory
- ADV-2010-2880 vdb-entryBroken LinkVendor Advisory
- http://www.microsoft.com/technet/security/advisory/2458511.mspx PatchVendor Advisory
- 1024676 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 15421 exploitThird Party AdvisoryVDB Entry
- http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Not Applicable
- ms-ie-flag-code-execution(62962) vdb-entryThird Party AdvisoryVDB Entry
- http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Vendor Advisory
- oval:org.mitre.oval:def:12279 vdb-entrysignatureTool Signature
- 15418 exploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962 US Government Resource
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*