CVE-2010-3962: microsoft internet explorer

csirt@kutim:~/threat-intel/cve/CVE-2010-3962

CVSS 8.1 · High KEV · sudah dieksploitasi EPSS 96,8%

Kerentanan Use After Free pada microsoft internet explorer. Skor CVSS 3.1 8.1 (High) menurut CISA ADP. Masuk katalog KEV CISA pada 6 Oktober 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.

Rincian

Terbit di NVD: 5 November 2010
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-416: Use After Free
EPSS (30 hari): 96,8% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
Masuk KEV: 6 Oktober 2025
Tenggat CISA: 27 Oktober 2025 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
microsoft	internet explorer	Versi 6
microsoft	internet explorer	Versi 7
microsoft	internet explorer	Versi 8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://blogs.technet.com/b/msrc/archive/2010/11/02/microsoft-releases-security-advisory-2458511.aspx advisory vendor
http://secunia.com/advisories/42091 broken link · advisory vendor
http://www.microsoft.com/technet/security/advisory/2458511.mspx patch · advisory vendor
http://www.vupen.com/english/advisories/2010/2880 broken link · advisory vendor
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090 patch · advisory vendor
http://www.kb.cert.org/vuls/id/899748 advisory pihak ketiga · pemerintah AS
http://www.us-cert.gov/cas/techalerts/TA10-348A.html advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3962 pemerintah AS
http://www.exploit-db.com/exploits/15418 advisory pihak ketiga · vdb entry
http://www.exploit-db.com/exploits/15421 advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/44536 broken link · advisory pihak ketiga · vdb entry
http://www.securitytracker.com/id?1024676 broken link · advisory pihak ketiga · vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/62962 advisory pihak ketiga · vdb entry
http://www.symantec.com/connect/blogs/new-ie-0-day-used-targeted-attacks not applicable
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12279 tool signature

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.