9.3

CVE-2010-3328

Use-after-free vulnerability in the CAttrArray::PrivateFind function in mshtml.dll in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code by setting an unspecified property of a stylesheet object, aka "Uninitialized Memory Corruption Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Internet Explorer Version 6
   Microsoft ≫ Windows Server 2003 Version - Update sp2
   Microsoft ≫ Windows Xp Version - Update sp2 SwEdition professional HwPlatform x64
   Microsoft ≫ Windows Xp Version - Update sp3
Microsoft ≫ Internet Explorer Version 7
   Microsoft ≫ Windows Server 2003 Version - Update sp2
   Microsoft ≫ Windows Server 2008 Version -
   Microsoft ≫ Windows Server 2008 Version - Update sp2
   Microsoft ≫ Windows Vista Version - Update sp1
   Microsoft ≫ Windows Vista Version - Update sp2
   Microsoft ≫ Windows Xp Version - Update sp2 SwEdition professional HwPlatform x64
   Microsoft ≫ Windows Xp Version - Update sp3
Microsoft ≫ Internet Explorer Version 8
   Microsoft ≫ Windows 7 Version -
   Microsoft ≫ Windows Server 2003 Version - Update sp2
   Microsoft ≫ Windows Server 2003 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version -
   Microsoft ≫ Windows Server 2008 Version - SwEdition - HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version - Update sp2
   Microsoft ≫ Windows Server 2008 Version - Update sp2 HwPlatform x64
   Microsoft ≫ Windows Server 2008 Version r2 HwPlatform itanium
   Microsoft ≫ Windows Server 2008 Version r2 HwPlatform x64
   Microsoft ≫ Windows Vista Version - Update sp1
   Microsoft ≫ Windows Vista Version - Update sp2
   Microsoft ≫ Windows Xp Version - Update sp2 SwEdition professional HwPlatform x64
   Microsoft ≫ Windows Xp Version - Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 31.93% 0.981
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.us-cert.gov/cas/techalerts/TA10-285A.html
Third Party Advisory
US Government Resource
http://support.avaya.com/css/P8/documents/100113324
Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071
Patch
Vendor Advisory
http://www.securityfocus.com/bid/43705
Third Party Advisory
Broken Link
VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-10-197/
Third Party Advisory
VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7059
Broken Link