CVE-2010-0491

Published Mar 31, 2010

Last updated a month ago

CVSS info 9.3

Overview

Description
Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML object that has an onreadystatechange event handler, aka "HTML Object Memory Corruption Vulnerability."
Source
secure@microsoft.com
NVD status
Modified
Products
internet_explorer, windows_2003_server, windows_server_2003, windows_xp, windows_2000

Risk scores

CVSS 2.0

Type
Primary
Base score
9.3
Impact score
10
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:C/I:C/A:C

Weaknesses

nvd@nist.gov
CWE-399

Social media

Hype score
Not currently trending

Evaluator

Comment
-
Impact
Per: http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx 'Internet Explorer 7 and Internet Explorer 8 are not affected by this vulnerability.'
Solution
Per: http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx 'Internet Explorer 7 and Internet Explorer 8 are not affected by this vulnerability.'

Configurations

Related CVEs

  1. Microsoft Internet Explorer Remote Code Execution Vulnerability•CVE-2021-27085
  2. Microsoft Internet Explorer Memory Corruption Vulnerability•CVE-2021-26411
  3. <p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>There are multiple ways an attacker could exploit the vulnerability:</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit this vulnerability, and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by ensuring the Wininit.dll properly handles objects in memory.</p>•CVE-2020-1506
  4. <p>An elevation of privilege vulnerability exists in the way that the Wininit.dll handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.</p> <p>There are multiple ways an attacker could exploit the vulnerability:</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit this vulnerability, and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by ensuring the Wininit.dll properly handles objects in memory.</p>•CVE-2020-1012
  5. Microsoft Edge and Internet Explorer Memory Corruption Vulnerability•CVE-2020-0878

References

Sources include official advisories and independent security research.