PT-2010-4739 · Microsoft · Internet Explorer
CVE-2010-3328
·
Publicado
2010-10-12
·
Atualizado
2024-02-02
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Internet Explorer versions 6 through 8
Description
A use-after-free issue in the CAttrArray::PrivateFind function in mshtml.dll allows remote attackers to execute arbitrary code by setting an unspecified property of a stylesheet object. This could allow an attacker to gain the same user rights as the logged-on user, potentially leading to complete control of an affected system if the user has administrative rights. The attacker could exploit this by constructing a specially crafted Web page.
Recommendations
For Microsoft Internet Explorer versions 6 through 8, consider disabling access to the
CAttrArray::PrivateFind function as a temporary workaround until a patch is available. Restrict the use of stylesheet objects to minimize the risk of exploitation. Avoid viewing specially crafted Web pages that could trigger the vulnerability.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.RCE
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Internet Explorer