CVE-2010-3971: Internet Explorer 6-8 may be hijacked or crashed by CSS

Internet Explorer versions 6 through 8 can be tricked into running malicious code or crashing when a specially crafted web page includes a self‑referencing @import rule in its stylesheet. This happens because the browser’s CSS parser mishandles memory, allowing an attacker to take control or cause the program to stop working. Apply the latest security updates from Microsoft or use a newer browser to protect your systems.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-i...
• http://seclists.org/fulldisclosure/2010/Dec/110 Exploit
• http://secunia.com/advisories/42510 Vendor Advisory
• http://support.avaya.com/css/P8/documents/100127294
• http://www.breakingpointsystems.com/community/blog/ie-vulnerability/ Exploit
• http://www.exploit-db.com/exploits/15708 Exploit
• http://www.exploit-db.com/exploits/15746 Exploit
• http://www.kb.cert.org/vuls/id/634956 US Government Resource
• http://www.microsoft.com/technet/security/advisory/2488013.mspx
• http://www.securityfocus.com/bid/45246
• http://www.securitytracker.com/id?1024922
• http://www.vupen.com/english/advisories/2010/3156 Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0318
• http://www.wooyun.org/bugs/wooyun-2010-0885 Exploit
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-00...
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...