Microsoft · Internet Explorer
CVE-2010-3962
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Was es ist
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
CISA: Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Was zu tun ist
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 27. Oktober 2025
- Zur CISA-Liste hinzugefügt
- 6. Oktober 2025
- Veröffentlicht
- 5. November 2010
- Schweregrad
- Hoch 8,1 CVSS 3.1
- Wahrscheinlichkeit von Angriffen in den nächsten 30 Tagen (EPSS)
- 97% unter den obersten 0,1% aller bekannten Schwachstellen
- Mehr Details
- NVD · CVE.org · CISA
Alle Quellen (14)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090
- http://www.securityfocus.com/bid/44536
- http://www.us-cert.gov/cas/techalerts/TA10-348A.html
- http://www.kb.cert.org/vuls/id/899748
- http://secunia.com/advisories/42091
- http://www.vupen.com/english/advisories/2010/2880
- http://www.microsoft.com/technet/security/advisory/2458511.mspx
- http://www.securitytracker.com/id?1024676
- http://www.exploit-db.com/exploits/15421
- http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62962
- http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279
- http://www.exploit-db.com/exploits/15418
Weitere ausgenutzte Schwachstellen von Microsoft
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 20.05.2026 | Use-After-Free | Internet Explorer | Hoch 8,8 | 92% |
| 20.05.2026 | Use-After-Free | Internet Explorer | Hoch 8,8 | 82% |
| 12.08.2025 | Resource Management Errors | Internet Explorer | Hoch 8,8 | 88% |
| 23.07.2024 | Use-After-Free | Internet Explorer | Hoch 8,8 | 79% |
| 30.03.2023 | Memory Corruption | Internet Explorer | Hoch 8,8 | 71% |
| 08.06.2022 | Use-After-Free | Internet Explorer | Hoch 8,1 | 80% |
| 25.05.2022 | Information Disclosure | Internet Explorer | Mittel 6,5 | 50% |
| 25.05.2022 | Privilege Escalation | Internet Explorer | Hoch 8,8 | 26% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.