National Cyber Awareness System

Vulnerability Summary for CVE-2010-3971

Overview

Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in Microsoft Internet Explorer 6 through 8 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a self-referential @import rule in a stylesheet, aka "CSS Memory Corruption Vulnerability."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#634956

Name: VU#634956

Hyperlink:http://www.kb.cert.org/vuls/id/634956

External Source: MISC

Name: http://www.wooyun.org/bugs/wooyun-2010-0885

Hyperlink:http://www.wooyun.org/bugs/wooyun-2010-0885

External Source: VUPEN

Name: ADV-2011-0318

Hyperlink:http://www.vupen.com/english/advisories/2011/0318

External Source: VUPEN

Name: ADV-2010-3156

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3156

External Source: SECTRACK

Name: 1024922

Hyperlink:http://www.securitytracker.com/id?1024922

External Source: BID

Name: 45246

Hyperlink:http://www.securityfocus.com/bid/45246

External Source: MS

Name: MS11-003

Hyperlink:http://www.microsoft.com/technet/security/Bulletin/MS11-003.mspx

External Source: MISC

Name: http://www.microsoft.com/technet/security/advisory/2488013.mspx

Hyperlink:http://www.microsoft.com/technet/security/advisory/2488013.mspx

External Source: EXPLOIT-DB

Name: 15746

Hyperlink:http://www.exploit-db.com/exploits/15746

External Source: EXPLOIT-DB

Name: 15708

Hyperlink:http://www.exploit-db.com/exploits/15708

External Source: MISC

Name: http://www.breakingpointsystems.com/community/blog/ie-vulnerability/

Hyperlink:http://www.breakingpointsystems.com/community/blog/ie-vulnerability/

External Source: CONFIRM

Name: http://support.avaya.com/css/P8/documents/100127294

Hyperlink:http://support.avaya.com/css/P8/documents/100127294

External Source: SECUNIA

Name: 42510

Type: Advisory

Hyperlink:http://secunia.com/advisories/42510

External Source: FULLDISC

Name: 20101208 IE CSS parser dos bug

Hyperlink:http://seclists.org/fulldisclosure/2010/Dec/110

External Source: OVAL

Name: oval:org.mitre.oval:def:12382

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12382

External Source: MISC

Name: http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

Hyperlink:http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx

References to Check Content

Identifier:oval:org.mitre.oval:def:12382

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12382