CVE-2010-3971 Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products,....
HighCVSS 9.3
EPSS 81.7%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a self-referential @import rule in a stylesheet, aka "CSS Memory Corruption Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 7 | No fix listed |
| Microsoft internet explorer | = 8 | No fix listed |
References
- blogs.technet.com
- 20101208 IE CSS parser dos bug exploit mailing-list
- 42510 third-party-advisory vendor-advisory
- support.avaya.com
- www.breakingpointsystems.com exploit
- 15708 exploit
- 15746 exploit
- VU#634956 third-party-advisory us-government-resource
- www.microsoft.com
- 45246 vdb-entry
- 1024922 vdb-entry
- ADV-2010-3156 vdb-entry vendor-advisory
- ADV-2011-0318 vdb-entry
- www.wooyun.org exploit
- MS11-003 vendor-advisory
- oval:org.mitre.oval:def:12382 signature vdb-entry