Vulnerability Details : CVE-2010-3962

Public exploit exists!
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
Published 2010-11-05 17:00:03
Updated 2022-02-28 19:15:52
Source Microsoft Corporation
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionExecute code

Exploit prediction scoring system (EPSS) score for CVE-2010-3962

Probability of exploitation activity in the next 30 days: 96.97%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2010-3962

  • MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption
    Disclosure Date: 2010-11-03
    First seen: 2020-04-26
    exploit/windows/browser/ms10_090_ie_css_clip
    This module exploits a memory corruption vulnerability within Microsoft's HTML engine (mshtml). When parsing an HTML page containing a specially crafted CSS tag, memory corruption occurs that can lead arbitrary code execution. It seems like Microsoft code

CVSS scores for CVE-2010-3962

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
9.3
 HIGH AV:N/AC:M/Au:N/C:C/I:C/A:C
8.6
10.0
 NIST

CWE ids for CVE-2010-3962

  • Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-3962

Products affected by CVE-2010-3962

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close