CVE-2010-0249: microsoft internet explorer

csirt@kutim:~/threat-intel/cve/CVE-2010-0249

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 91,9%

Kerentanan Use After Free pada microsoft internet explorer. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 20 Mei 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."

Rincian

Terbit di NVD: 15 Januari 2010
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-416: Use After Free
EPSS (30 hari): 91,9% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft Internet Explorer Use-After-Free Vulnerability
Masuk KEV: 20 Mei 2026
Tenggat CISA: 3 Juni 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	internet explorer	Versi 5.0.1 sp4
microsoft	internet explorer	Versi 6 sp1
microsoft	internet explorer	Versi 6
microsoft	internet explorer	Versi 7.0
microsoft	internet explorer	Versi 8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx broken link · advisory vendor
http://support.microsoft.com/kb/979352 patch · advisory vendor
http://www.microsoft.com/technet/security/advisory/979352.mspx broken link · patch · advisory vendor
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002 patch · advisory vendor
http://www.kb.cert.org/vuls/id/492515 advisory pihak ketiga · pemerintah AS
http://www.us-cert.gov/cas/techalerts/TA10-055A.html broken link · advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0249 pemerintah AS
http://securitytracker.com/id?1023462 broken link · advisory pihak ketiga · vdb entry
http://www.exploit-db.com/exploits/11167 exploit · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/37815 broken link · exploit · advisory pihak ketiga · vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/55642 advisory pihak ketiga · vdb entry
http://news.cnet.com/8301-27080_3-10435232-245.html broken link
http://osvdb.org/61697 broken link
http://www.vupen.com/english/advisories/2010/0135 broken link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6835 broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.