CVE-2010-3962

high-risk
Published 2010-11-05

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

Do I need to act?

!
89.9% chance of exploitation in next 30 days
EPSS score — higher than 10% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
3 public exploits available
15418, 16551, 15421
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / HIGH complexity

Affected Products (3)

Affected Vendors

Microsoft

References (29)

Vendor Advisory http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-a...
Broken Link http://secunia.com/advisories/42091
Third Party Advisory http://www.exploit-db.com/exploits/15418
Third Party Advisory http://www.exploit-db.com/exploits/15421
Third Party Advisory http://www.kb.cert.org/vuls/id/899748
Patch http://www.microsoft.com/technet/security/advisory/2458511.mspx
Broken Link http://www.securityfocus.com/bid/44536
Broken Link http://www.securitytracker.com/id?1024676
Not Applicable http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks
Third Party Advisory http://www.us-cert.gov/cas/techalerts/TA10-348A.html
Broken Link http://www.vupen.com/english/advisories/2010/2880
Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-09...
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/62962
Tool Signature https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...
Vendor Advisory http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-a...
Broken Link http://secunia.com/advisories/42091
Third Party Advisory http://www.exploit-db.com/exploits/15418
Third Party Advisory http://www.exploit-db.com/exploits/15421
Third Party Advisory http://www.kb.cert.org/vuls/id/899748
Patch http://www.microsoft.com/technet/security/advisory/2458511.mspx
and 9 more references
67
/ 100
high-risk
Severity 24/34 · High
Exploitability 34/34 · Critical
Exposure 9/34 · Low