CVSS: 10.0EPSS: 97%CPEs: 59EXPL: 1CVE-2010-0248 – Microsoft Internet Explorer item Object Memory Corruption Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0248
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Object Memory Corruption Vulnerability." Microsoft Internet Explorer 6, 6 SP1, 7 y 8 no maneja de manera apropiada los objetos en memoria lo que permite a atacantes remotos ejecutar código de su elección accediendo a un objeto que (1) no fue correctamente iniciado o (2) es borrado, lo que conduce a una corrupción de memoria, también conocida como "Vulnerabilidad de Corrupción de Memoria del Objeto HTML". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists in the handling of cloned DOM objects in JavaScript. A specially crafted sequence of object cloning can result in the use of a pointer after it has been freed. • https://www.exploit-db.com/exploits/18642 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002 https://exchange.xforce.ibmcloud.com/vulnerabilities/55778 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8267 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-416: Use After Free •
CVSS: 9.3EPSS: 95%CPEs: 33EXPL: 4CVE-2010-0249 – Microsoft Internet Explorer - 'Aurora' Memory Corruption (MS10-002)
https://notcve.org/view.php?id=CVE-2010-0249
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability." Vulnerabilidad de uso después de liberación en Microsoft Internet Explorer 6, 6 SP1, 7 y 8 en Windows 2000 SP4; Windows XP SP2 y SP3; Windows Server 2003 SP2; Windows Vista Gold SP1 y SP2; Windows Server 2008 Gold, SP2 y R2; y Windows 7; permite a atacantes remotos ejecutar código de su elección accediendo a un puntero asociado a un objeto eliminado, como se ha explotado activamente en Enero 2010. • https://www.exploit-db.com/exploits/16599 https://www.exploit-db.com/exploits/11167 http://blogs.technet.com/msrc/archive/2010/01/14/security-advisory-979352.aspx http://news.cnet.com/8301-27080_3-10435232-245.html http://osvdb.org/61697 http://securitytracker.com/id?1023462 http://support.microsoft.com/kb/979352 http://www.exploit-db.com/exploits/11167 http://www.kb.cert.org/vuls/id/492515 http://www.microsoft.com/technet/security/advisory/979352.mspx http:/ • CWE-416: Use After Free •
CVSS: 9.3EPSS: 95%CPEs: 20EXPL: 0CVE-2010-0018
https://notcve.org/view.php?id=CVE-2010-0018
Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font, aka "Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability." Desbordamiento de enteros en el motor de fuente de Embedded OpenType (EOT) (t2embed.dll) en Microsoft Windows 2000 SP4; Windows XP SP2 y SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1 y SP2; Windows Server 2008 Gold, SP2 y R2; y Windows 7 permite que los atacantes remotos ejecuten código arbitrario por medio de datos comprimidos que representan una fuente EOT creada, también conocida como "Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability." • http://blogs.technet.com/srd/archive/2010/01/12/ms10-001-font-file-decompression-vulnerability.aspx http://osvdb.org/61651 http://secunia.com/advisories/35457 http://www.securityfocus.com/bid/37671 http://www.securitytracker.com/id?1023432 http://www.us-cert.gov/cas/techalerts/TA10-012B.html http://www.vupen.com/english/advisories/2010/0095 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-001 https://oval.cisecurity.org/repository/search/definition/oval • CWE-189: Numeric Errors •
CVSS: 9.3EPSS: 9%CPEs: 7EXPL: 0CVE-2009-4311
https://notcve.org/view.php?id=CVE-2009-4311
Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Paul Byrne of NGS Software. NOTE: this might overlap CVE-2008-3615. Vulnerabilidad sin especificar en el codec Indeo en Microsoft Windows 2000 SP4, XP SP2 y SP3, y Server 2003 SP2 permite a atacantes remotos ejecutar código arbitrario a través de contenido multimedia manipulado, como reporto Paul Byrne de NGS Sfotware. NOTA: Esta probablemente se solape con CVE-2008-3615. • http://secunia.com/advisories/37592 http://securitytracker.com/id?1023302 http://support.microsoft.com/kb/954157 http://support.microsoft.com/kb/955759 http://support.microsoft.com/kb/976138 http://www.microsoft.com/technet/security/advisory/954157.mspx http://www.securityfocus.com/bid/37251 http://www.vupen.com/english/advisories/2009/3440 https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11975 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 10%CPEs: 7EXPL: 0CVE-2009-4313
https://notcve.org/view.php?id=CVE-2009-4313
ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (heap corruption) or execute arbitrary code via malformed data in a stream in a media file, as demonstrated by an AVI file. ir32_32.dll 3.24.15.3 en el codec Indeo32 en Microsoft Windows 2000 SP4, XP SP2 y SP3, y Server 2003 SP2 permite a atacantes remotos producir una denegación de servicio (corrupción de memoria libre) o ejecutar código arbitrario a través de datos malformados en un stream en un fichero multimedia, como se demuestra en un fichero AVI. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=835 http://secunia.com/advisories/37592 http://securitytracker.com/id?1023302 http://support.microsoft.com/kb/954157 http://support.microsoft.com/kb/955759 http://support.microsoft.com/kb/976138 http://www.microsoft.com/technet/security/advisory/954157.mspx http://www.osvdb.org/60858 http://www.securityfocus.com/bid/37251 http://www.vupen.com/english/advisories/2009/3440 https://exchange.xforce.ibmcloud.com/vu • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •