PT-2010-5197 · Microsoft · Internet Explorer

Jose Antonio Vazquez Gonzalez · Published 2010-11-05 · Updated 2025-10-07 · CVE-2010-3962

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 8

Description The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code. This can be achieved through vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute. An attacker could exploit this by convincing a user to open a malicious document, potentially leading to remote code execution when the document is closed. If successfully exploited, an attacker could gain the same user rights as the logged-on user, and if the user has administrative rights, the attacker could take complete control of the system.

Recommendations For Microsoft Internet Explorer versions 6 through 8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2010-3962

Affected Products

Internet Explorer

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb · Exploit
• 🔥 http://exploit-db.com/exploits/15418 · Exploit
• 🔥 https://exploit-db.com/exploits/16551 · Exploit
• 🔥 https://exploit-db.com/exploits/15418 · Exploit
• 🔥 http://exploit-db.com/exploits/15421 · Exploit
• 🔥 https://exploit-db.com/exploits/15421 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3962 · Security Note
• http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx · Vendor Advisory
• http://secunia.com/advisories/42091 · Vendor Advisory
• http://microsoft.com/technet/security/advisory/2458511.mspx · Vendor Advisory
• https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/2458511?redirectedfrom=MSDN · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-3962 · Security Note
• http://vupen.com/english/advisories/2010/2880 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA10-348A.html · Note