cvelistv5 - cve-2010-0806

CVE-2010-0806 (GCVE-0-2010-0806)

Vulnerability from cvelistv5

Published

2010-03-10 22:00

Modified

2026-05-21 03:55

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."

References

URL

Tags

	http://osvdb.org/62810	vdb-entry, x_refsource_OSVDB
	http://www.us-cert.gov/cas/techalerts/TA10-089A.html	third-party-advisory, x_refsource_CERT
	http://www.securityfocus.com/bid/38615	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2010/0567	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/38860	third-party-advisory, x_refsource_SECUNIA
	http://www.us-cert.gov/cas/techalerts/TA10-068A.html	third-party-advisory, x_refsource_CERT
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018	vendor-advisory, x_refsource_MS
	http://www.microsoft.com/technet/security/advisory/981374.mspx	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/56772	vdb-entry, x_refsource_XF
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2010/0744	vdb-entry, x_refsource_VUPEN
	http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx	x_refsource_CONFIRM
	http://www.kb.cert.org/vuls/id/744549	third-party-advisory, x_refsource_CERT-VN

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2026-05-20

Due date: 2026-06-03

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Used in ransomware: Unknown

Notes: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:59:39.106Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62810",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/62810"
          },
          {
            "name": "TA10-089A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html"
          },
          {
            "name": "38615",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/38615"
          },
          {
            "name": "ADV-2010-0567",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0567"
          },
          {
            "name": "38860",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38860"
          },
          {
            "name": "TA10-068A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html"
          },
          {
            "name": "MS10-018",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.microsoft.com/technet/security/advisory/981374.mspx"
          },
          {
            "name": "ms-ie-useafterfree-code-execution(56772)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772"
          },
          {
            "name": "oval:org.mitre.oval:def:8446",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446"
          },
          {
            "name": "ADV-2010-0744",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0744"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx"
          },
          {
            "name": "VU#744549",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/744549"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2010-0806",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-05-20",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T03:55:29.109Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory"
            ],
            "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-20T00:00:00.000Z",
            "value": "CVE-2010-0806 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-03-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "62810",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/62810"
        },
        {
          "name": "TA10-089A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html"
        },
        {
          "name": "38615",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/38615"
        },
        {
          "name": "ADV-2010-0567",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0567"
        },
        {
          "name": "38860",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38860"
        },
        {
          "name": "TA10-068A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html"
        },
        {
          "name": "MS10-018",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.microsoft.com/technet/security/advisory/981374.mspx"
        },
        {
          "name": "ms-ie-useafterfree-code-execution(56772)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772"
        },
        {
          "name": "oval:org.mitre.oval:def:8446",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446"
        },
        {
          "name": "ADV-2010-0744",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0744"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx"
        },
        {
          "name": "VU#744549",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/744549"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2010-0806",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized Memory Corruption Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "62810",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/62810"
            },
            {
              "name": "TA10-089A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html"
            },
            {
              "name": "38615",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/38615"
            },
            {
              "name": "ADV-2010-0567",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0567"
            },
            {
              "name": "38860",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38860"
            },
            {
              "name": "TA10-068A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html"
            },
            {
              "name": "MS10-018",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/981374.mspx",
              "refsource": "CONFIRM",
              "url": "http://www.microsoft.com/technet/security/advisory/981374.mspx"
            },
            {
              "name": "ms-ie-useafterfree-code-execution(56772)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56772"
            },
            {
              "name": "oval:org.mitre.oval:def:8446",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446"
            },
            {
              "name": "ADV-2010-0744",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0744"
            },
            {
              "name": "http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx",
              "refsource": "CONFIRM",
              "url": "http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx"
            },
            {
              "name": "VU#744549",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/744549"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2010-0806",
    "datePublished": "2010-03-10T22:00:00.000Z",
    "dateReserved": "2010-03-02T00:00:00.000Z",
    "dateUpdated": "2026-05-21T03:55:29.109Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2010-0806",
      "cwes": "[\"CWE-399\"]",
      "dateAdded": "2026-05-20",
      "dueDate": "2026-06-03",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806",
      "product": "Internet Explorer",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.",
      "vendorProject": "Microsoft",
      "vulnerabilityName": "Microsoft Internet Explorer Use-After-Free Vulnerability"
    }
  }
}

CERTA-2010-ALE-004

Vulnerability from certfr_alerte

Une vulnérabilité dans Microsoft Internet Explorer permet l'exécution de code arbitraire à distance.

L'éditeur a publié un correctif pour remédier à cette vulnérabilité.

Description

Une vulnérabilité a été identifiée dans Microsoft Internet Explorer. Son exploitation permet l'exécution de code arbitraire à distance en incitant une victime à visiter une page Web spécialement conçue. L'éditeur Microsoft annonce que plusieurs cas d'attaques utilisant cette faille ont été découverts.

Le CERTA rappelle que si la vulnérabilité touche le navigateur Internet Explorer, d'autres vecteurs que des pages internet peuvent être utilisés. Notamment, il est possible d'exploiter cette faille au moyen de documents Microsoft Office spécialement conçus (cf. bulletin d'actualité CERTA-2009-ACT-012).

Contournement provisoire

Le CERTA recommande l'application du contournement suivant, qui consiste à retirer les droits d'accès à la bibliothèque iepeers.dll. Ceci peut avoir des effets de bord sur certaines fonctionnalités étendues de MSHTML (impression, répertoires Web).

Sur les systèmes 32 bits :

Echo y| cacls %WINDIR%\SYSTEM32\iepeers.DLL /E /P "Tout le monde":N

Sur les systèmes 64 bits :

Echo y| cacls %WINDIR%\SYSWOW64\iepeers.DLL /E /P "Tout le monde":N

Pour désactiver ce contournement et autoriser l'accès à cette bibliothèque :

Sur les systèmes 32 bits :

cacls %WINDIR%\SYSTEM32\iepeers.dll /E /R "Tout le monde"

Sur les systèmes 64 bits :

cacls %WINDIR%\SYSWOW64\iepeers.dll /E /R "Tout le monde"

Ce contournement fonctionne pour tous les vecteurs d'attaque (page Web, document Microsoft Office, etc.) et est donc recommandé même si Internet Explorer n'est pas le logiciel par défaut utilisé pour la navigation. L'installation d'Internet Explorer 8 permet également de contourner la vulnérabilité pour tous les vecteurs d'attaque.

Si les contournements précédents s'avèrent inapplicables, il est recommandé de naviguer avec un navigateur alternatif et d'appliquer les contournements spécifiques à l'exploitation de la vulnérabilité via des documents Microsoft Office (cf. bulletin d'actualité CERTA-2009-ACT-012).

Le CERTA rappelle, de plus, qu'il recommandé de naviguer avec un compte utilisateur aux droits restreints et de désactiver l'interprétation de code dynamique (Javascript, ActiveX). De plus, l'activation du DEP (Data Execution Prevention) peut limiter l'impact de cette vulnérabilité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	N/A	Internet Explorer 6 Service Pack 1 ;
Microsoft	N/A	Internet Explorer 6 ;
Microsoft	N/A	Internet Explorer 7.

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS10-018 du 30 mars 2010	None	vendor-advisory
Avis de sécurité Microsoft #981374 du 09 mars 2010	None	vendor-advisory
Avis du CERTA CERTA-2010-AVI-146 du 31 mars 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Internet Explorer 6 Service Pack 1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 6 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 7.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2010-03-31",
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans Microsoft Internet Explorer. Son\nexploitation permet l\u0027ex\u00e9cution de code arbitraire \u00e0 distance en\nincitant une victime \u00e0 visiter une page Web sp\u00e9cialement con\u00e7ue.\nL\u0027\u00e9diteur Microsoft annonce que plusieurs cas d\u0027attaques utilisant cette\nfaille ont \u00e9t\u00e9 d\u00e9couverts.\n\nLe CERTA rappelle que si la vuln\u00e9rabilit\u00e9 touche le navigateur Internet\nExplorer, d\u0027autres vecteurs que des pages internet peuvent \u00eatre\nutilis\u00e9s. Notamment, il est possible d\u0027exploiter cette faille au moyen\nde documents Microsoft Office sp\u00e9cialement con\u00e7us (cf. bulletin\nd\u0027actualit\u00e9 CERTA-2009-ACT-012).\n\n## Contournement provisoire\n\nLe CERTA recommande l\u0027application du contournement suivant, qui consiste\n\u00e0 retirer les droits d\u0027acc\u00e8s \u00e0 la biblioth\u00e8que iepeers.dll. Ceci peut\navoir des effets de bord sur certaines fonctionnalit\u00e9s \u00e9tendues de\nMSHTML (impression, r\u00e9pertoires Web).\n\nSur les syst\u00e8mes 32 bits :\n\n    Echo y| cacls %WINDIR%\\SYSTEM32\\iepeers.DLL /E /P \"Tout le monde\":N\n\nSur les syst\u00e8mes 64 bits :\n\n    Echo y| cacls %WINDIR%\\SYSWOW64\\iepeers.DLL /E /P \"Tout le monde\":N\n\nPour d\u00e9sactiver ce contournement et autoriser l\u0027acc\u00e8s \u00e0 cette\nbiblioth\u00e8que :\n\nSur les syst\u00e8mes 32 bits :\n\n    cacls %WINDIR%\\SYSTEM32\\iepeers.dll /E /R \"Tout le monde\"\n\nSur les syst\u00e8mes 64 bits :\n\n    cacls %WINDIR%\\SYSWOW64\\iepeers.dll /E /R \"Tout le monde\"\n\nCe contournement fonctionne pour tous les vecteurs d\u0027attaque (page Web,\ndocument Microsoft Office, etc.) et est donc recommand\u00e9 m\u00eame si Internet\nExplorer n\u0027est pas le logiciel par d\u00e9faut utilis\u00e9 pour la navigation.\nL\u0027installation d\u0027Internet Explorer 8 permet \u00e9galement de contourner la\nvuln\u00e9rabilit\u00e9 pour tous les vecteurs d\u0027attaque.\n\nSi les contournements pr\u00e9c\u00e9dents s\u0027av\u00e8rent inapplicables, il est\nrecommand\u00e9 de naviguer avec un navigateur alternatif et d\u0027appliquer les\ncontournements sp\u00e9cifiques \u00e0 l\u0027exploitation de la vuln\u00e9rabilit\u00e9 via des\ndocuments Microsoft Office (cf. bulletin d\u0027actualit\u00e9\nCERTA-2009-ACT-012).\n\nLe CERTA rappelle, de plus, qu\u0027il recommand\u00e9 de naviguer avec un compte\nutilisateur aux droits restreints et de d\u00e9sactiver l\u0027interpr\u00e9tation de\ncode dynamique (Javascript, ActiveX). De plus, l\u0027activation du DEP (Data\nExecution Prevention) peut limiter l\u0027impact de cette vuln\u00e9rabilit\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-0806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0806"
    }
  ],
  "initial_release_date": "2010-03-10T00:00:00",
  "last_revision_date": "2010-03-31T00:00:00",
  "links": [
    {
      "title": "Avis du CERTA CERTA-2010-AVI-146 du 31 mars 2010 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2010-AVI-146/"
    }
  ],
  "reference": "CERTA-2010-ALE-004",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-03-10T00:00:00.000000"
    },
    {
      "description": "publication du correctif.",
      "revision_date": "2010-03-31T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans Microsoft Internet Explorer permet l\u0027ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n\nL\u0027\u00e9diteur a publi\u00e9 un correctif pour rem\u00e9dier \u00e0 cette vuln\u00e9rabilit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Internet Explorer",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-018 du 30 mars 2010",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx"
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 Microsoft #981374 du 09 mars 2010",
      "url": "http://www.microsoft.com/france/technet/security/advisory/981374.mspx"
    }
  ]
}

CERTA-2010-AVI-146

Vulnerability from certfr_avis

Plusieurs vulnérabilités affectent Microsoft Internet Explorer et pemettent d'exécuter du code arbitraire à distance ou d'accéder à des données sensibles.

Description

Plusieurs vulnérabilités affectant Microsoft Internet Explorer ont été publiées. Leur exploitation permet d'exécuter du code arbitraire à distance ou d'accéder à des données sensibles.

Toutes les vulnérabilités n'affectent pas toutes les versions, et une même vulnérabilité peut avoir un impact différent selon les versions du logiciel.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Le correctif remédie à la vulnérabilité décrite dans l'alerte du CERTA CERTA-2010-ALE-004.

Microsoft Internet Explorer, toutes les versions.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS10-018 du 30 mars 2010	None	vendor-advisory
Alerte du CERTA CERTA-2010-ALE-004 du 31 mars 2010 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eMicrosoft Internet Explorer, toutes les  versions.\u003c/p\u003e",
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s affectant Microsoft Internet Explorer ont \u00e9t\u00e9\npubli\u00e9es. Leur exploitation permet d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance ou d\u0027acc\u00e9der \u00e0 des donn\u00e9es sensibles.\n\nToutes les vuln\u00e9rabilit\u00e9s n\u0027affectent pas toutes les versions, et une\nm\u00eame vuln\u00e9rabilit\u00e9 peut avoir un impact diff\u00e9rent selon les versions du\nlogiciel.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\nLe correctif rem\u00e9die \u00e0 la vuln\u00e9rabilit\u00e9 d\u00e9crite dans l\u0027alerte du CERTA\nCERTA-2010-ALE-004.\n",
  "cves": [
    {
      "name": "CVE-2010-0806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0806"
    },
    {
      "name": "CVE-2010-0267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0267"
    },
    {
      "name": "CVE-2010-0491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0491"
    },
    {
      "name": "CVE-2010-0488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0488"
    },
    {
      "name": "CVE-2010-0492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0492"
    },
    {
      "name": "CVE-2010-0805",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0805"
    },
    {
      "name": "CVE-2010-0490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0490"
    },
    {
      "name": "CVE-2010-0489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0489"
    },
    {
      "name": "CVE-2010-0807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0807"
    },
    {
      "name": "CVE-2010-0494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-0494"
    }
  ],
  "initial_release_date": "2010-03-31T00:00:00",
  "last_revision_date": "2010-03-31T00:00:00",
  "links": [
    {
      "title": "Alerte du CERTA CERTA-2010-ALE-004 du 31 mars 2010 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2010-ALE-004/"
    }
  ],
  "reference": "CERTA-2010-AVI-146",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-03-31T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s affectent Microsoft Internet Explorer et\npemettent d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance ou d\u0027acc\u00e9der \u00e0 des\ndonn\u00e9es sensibles.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Internet Explorer",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS10-018 du 30 mars 2010",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS10-018.mspx"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2010-0806 (GCVE-0-2010-0806)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

CERTA-2010-ALE-004

Vulnerability from certfr_alerte

Description

Contournement provisoire

Solution

CERTA-2010-AVI-146

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature