Veille CVE
CVE-2010-3962
8.1 Élevée Exploitée activementCatalogue CISA KEV — Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Ajoutée le 06/10/2025 · Échéance de correction (agences US) : 27/10/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.1 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 9.3 Élevée | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Vendor Advisory
- http://secunia.com/advisories/42091 Broken LinkVendor Advisory
- http://www.exploit-db.com/exploits/15418 Third Party AdvisoryVDB Entry
- http://www.exploit-db.com/exploits/15421 Third Party AdvisoryVDB Entry
- http://www.kb.cert.org/vuls/id/899748 Third Party AdvisoryUS Government Resource
- http://www.microsoft.com/technet/security/advisory/2458511.mspx PatchVendor Advisory
- http://www.securityfocus.com/bid/44536 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1024676 Broken LinkThird Party AdvisoryVDB Entry
- http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Not Applicable
- http://www.us-cert.gov/cas/techalerts/TA10-348A.html Third Party AdvisoryUS Government Resource
- http://www.vupen.com/english/advisories/2010/2880 Broken LinkVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62962 Third Party AdvisoryVDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 Tool Signature
- http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Vendor Advisory
- http://secunia.com/advisories/42091 Broken LinkVendor Advisory
- http://www.exploit-db.com/exploits/15418 Third Party AdvisoryVDB Entry
- http://www.exploit-db.com/exploits/15421 Third Party AdvisoryVDB Entry
- http://www.kb.cert.org/vuls/id/899748 Third Party AdvisoryUS Government Resource
- http://www.microsoft.com/technet/security/advisory/2458511.mspx PatchVendor Advisory
- http://www.securityfocus.com/bid/44536 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1024676 Broken LinkThird Party AdvisoryVDB Entry
- http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Not Applicable
- http://www.us-cert.gov/cas/techalerts/TA10-348A.html Third Party AdvisoryUS Government Resource
- http://www.vupen.com/english/advisories/2010/2880 Broken LinkVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62962 Third Party AdvisoryVDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 Tool Signature
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962 US Government Resource