CVE-2010-0806

Опубликовано: 10 мар. 2010

Источник: nvd

CVSS2: 9.3

EPSS Критический

Описание

Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."

Комментарий

Further information on this vulnerability can be found at the following link from Microsoft:

http://support.microsoft.com/kb/981374

Ссылки

http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx
http://osvdb.org/62810
http://secunia.com/advisories/38860
Vendor Advisory
http://www.kb.cert.org/vuls/id/744549
Patch
US Government Resource
http://www.microsoft.com/technet/security/advisory/981374.mspx
Patch
Vendor Advisory
http://www.securityfocus.com/bid/38615
http://www.us-cert.gov/cas/techalerts/TA10-068A.html
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA10-089A.html
US Government Resource
http://www.vupen.com/english/advisories/2010/0567
Vendor Advisory
http://www.vupen.com/english/advisories/2010/0744
Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
https://exchange.xforce.ibmcloud.com/vulnerabilities/56772
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446
http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx
http://osvdb.org/62810
http://secunia.com/advisories/38860
Vendor Advisory
http://www.kb.cert.org/vuls/id/744549
Patch
US Government Resource
http://www.microsoft.com/technet/security/advisory/981374.mspx
Patch
Vendor Advisory
http://www.securityfocus.com/bid/38615
http://www.us-cert.gov/cas/techalerts/TA10-068A.html
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

EPSS

Процентиль: 100%

0.90864

Критический

9.3 Critical

CVSS2

Дефекты

CWE-399

Связанные уязвимости

GHSA-f5rx-x946-jm33

github

почти 4 года назад

EPSS

Процентиль: 100%

0.90864

Критический

9.3 Critical

CVSS2

Дефекты

CWE-399