CVE-2010-0490

Microsoft Internet Explorer 6, 6 SP1, 7, and 8 - Remote Code Execution via Uninitialized Memory Corruption

Title source: llm
STIX 2.1

Description

Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8302
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA10-089A.html
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA10-068A.html
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/39031
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0744
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1023773

Scores

EPSS 0.2932
EPSS Percentile 97.9%

Details

CWE
CWE-94
Status published
Products (10)
microsoft/internet_explorer 7
microsoft/internet_explorer 6
microsoft/internet_explorer 8
microsoft/internet_explorer 8.0.6001
microsoft/windows_2003_server (2 CPE variants)
microsoft/windows_7
microsoft/windows_server_2003
microsoft/windows_server_2008 (9 CPE variants)
microsoft/windows_vista (6 CPE variants)
microsoft/windows_xp (3 CPE variants)
Published Mar 31, 2010
Tracked Since Feb 18, 2026