| Vulnerability Name: | CVE-2010-3962 (CCN-62962) | ||||||||
| Assigned: | 2010-11-03 | ||||||||
| Published: | 2010-11-03 | ||||||||
| Updated: | 2022-02-28 | ||||||||
| Summary: | Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010. | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 7.3 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
7.3 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-416 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CONFIRM Type: Vendor Advisory http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx Source: CCN Type: Microsoft TechNet Blog DEP, EMET protect against attacks on the latest Internet Explorer vulnerability Source: MITRE Type: CNA CVE-2010-3962 Source: CCN Type: SA42091 Internet Explorer CSS Tag Parsing Code Execution Vulnerability Source: SECUNIA Type: Broken Link, Vendor Advisory 42091 Source: CCN Type: SECTRACK ID: 1024676 Microsoft Internet Explorer Freed Object Invalid Flag Reference Access Lets Remote Users Execute Arbitrary Code Source: CCN Type: Microsoft Security Bulletin MS11-099 Cumulative Security Update for Internet Explorer (2618444) Source: CCN Type: Microsoft Security Bulletin MS12-010 Cumulative Security Update for Internet Explorer (2647516) Source: CCN Type: Microsoft Security Bulletin MS12-023 Cumulative Security Update for Internet Explorer (2675157) Source: CCN Type: Microsoft Security Bulletin MS12-037 Cumulative Security Update for Internet Explorer (2699988) Source: CCN Type: Microsoft Security Bulletin MS12-044 Cumulative Security Update for Internet Explorer (2719177) Source: CCN Type: Microsoft Security Bulletin MS12-052 Cumulative Security Update for Internet Explorer (2722913) Source: EXPLOIT-DB Type: Third Party Advisory, VDB Entry 15418 Source: EXPLOIT-DB Type: Third Party Advisory, VDB Entry 15421 Source: CCN Type: IBM Security Solutions Protection Alert Microsoft Internet Explorer Could Allow Remote Code Execution Source: CCN Type: US-CERT VU#899748 Microsoft Internet Explorer invalid flag reference vulnerability Source: CERT-VN Type: Third Party Advisory, US Government Resource VU#899748 Source: CCN Type: Microsoft Security Advisory (2458511) Vulnerability in Internet Explorer Could Allow Remote Code Execution Source: CONFIRM Type: Patch, Vendor Advisory http://www.microsoft.com/technet/security/advisory/2458511.mspx Source: CCN Type: Microsoft Security Bulletin MS10-090 Cumulative Security Update for Internet Explorer (2416400) Source: CCN Type: Microsoft Security Bulletin MS11-003 Cumulative Security Update for Internet Explorer (2482017) Source: CCN Type: Microsoft Security Bulletin MS11-018 Cumulative Security Update for Internet Explorer (2497640) Source: CCN Type: Microsoft Security Bulletin MS11-050 Cumulative Security Update for Internet Explorer (2530548) Source: CCN Type: Microsoft Security Bulletin MS11-057 Cumulative Security Update for Internet Explorer (2559049) Source: CCN Type: Microsoft Security Bulletin MS11-081 Cumulative Security Update for Internet Explorer (2586448) Source: BID Type: Broken Link, Third Party Advisory, VDB Entry 44536 Source: CCN Type: BID-44536 Microsoft Internet Explorer CSS Tags Uninitialized Memory Remote Code Execution Vulnerability Source: SECTRACK Type: Broken Link, Third Party Advisory, VDB Entry 1024676 Source: MISC Type: Not Applicable http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks Source: CERT Type: Third Party Advisory, US Government Resource TA10-348A Source: VUPEN Type: Broken Link, Vendor Advisory ADV-2010-2880 Source: MS Type: Patch, Vendor Advisory MS10-090 Source: XF Type: Third Party Advisory, VDB Entry ms-ie-flag-code-execution(62962) Source: XF Type: UNKNOWN ms-ie-flag-code-execution(62962) Source: OVAL Type: Tool Signature oval:org.mitre.oval:def:12279 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [11-04-2010] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [01-20-2011] | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration 3: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||