VulnerabilityModified

CVE-2010-3189

The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCtrl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer.

HIGH 9.3EPSS 39.2%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 39.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 39.22% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: trendmicro/internet security
Source: cve@mitre.org

References

http://esupport.trendmicro.com/pages/Hot-Fix-UfPBCtrldll-is-vulnerable-to-remote-attackers.aspxPatch, Vendor Advisory
http://secunia.com/advisories/41140Vendor Advisory
http://www.securityfocus.com/archive/1/513327/100/0/threaded
http://www.securitytracker.com/id?1024364
http://www.vupen.com/english/advisories/2010/2185Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-165
https://exchange.xforce.ibmcloud.com/vulnerabilities/61397
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7633
http://esupport.trendmicro.com/pages/Hot-Fix-UfPBCtrldll-is-vulnerable-to-remote-attackers.aspxPatch, Vendor Advisory
http://secunia.com/advisories/41140Vendor Advisory
http://www.securityfocus.com/archive/1/513327/100/0/threaded
http://www.securitytracker.com/id?1024364
http://www.vupen.com/english/advisories/2010/2185Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-10-165
https://exchange.xforce.ibmcloud.com/vulnerabilities/61397
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7633

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.