Microsoft Internet Explorer Use-After-Free Vulnerability

Summary

Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

Remediation

1. Inventory every Microsoft Internet Explorer deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.
3. Review logs from before the change for signs of exploitation.

References

• Advisoryhttps://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374
• Advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2010-0806
• Advisoryhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
• Advisoryhttps://learn.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018
• Referencehttps://exchange.xforce.ibmcloud.com/vulnerabilities/56772
• Referencehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8446
• Referencehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0806