CVSS: 9.3EPSS: 23%CPEs: 13EXPL: 4CVE-2006-4868 – Microsoft Internet Explorer (Windows XP SP2) - 'VML' Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-4868
Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag. Desbordamiento de búfer basado en el motor Vector Graphics Rendering (vgx.dll), tal y como se usa en Microsoft Outlook e Internet Explorer 6.0 en Windows XP SP2 y posiblemente otras versiones permite a atacantes remotos ejecutar código de su elección mediante un fichero Vector Markup Language (VML) con un parámetro "fill" largo dentro de una etiqueta "rect". • https://www.exploit-db.com/exploits/2425 https://www.exploit-db.com/exploits/16597 https://www.exploit-db.com/exploits/2426 http://blogs.securiteam.com/index.php/archives/624 http://secunia.com/advisories/21989 http://securitytracker.com/id?1016879 http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-being.html http://support.microsoft.com/kb/925486 http://www.kb.cert.org/vuls/id/416092 http://www.microsoft.com/technet/security/advisory/925568.mspx ht • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 92%CPEs: 4EXPL: 3CVE-2006-3915 – Microsoft Internet Explorer 6 - Native Function Iterator Denial of Service
https://notcve.org/view.php?id=CVE-2006-3915
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by iterating over any native function, as demonstrated with the window.alert function, which triggers a null dereference. Microsoft Internet Explorer 6 sobre Windows XP SP2 permite a atacantes remotos provocar denegación de servicio (caida) a travès de la iteración sobre cualquier función nativa, como se demostro con la función window.alert, lo cual dispara un referencia null. • https://www.exploit-db.com/exploits/28265 http://browserfun.blogspot.com/2006/07/mobb-25-native-function-iterator.html http://www.osvdb.org/27373 http://www.securityfocus.com/bid/19140 http://www.vupen.com/english/advisories/2006/2955 https://exchange.xforce.ibmcloud.com/vulnerabilities/27932 •
CVSS: 5.0EPSS: 96%CPEs: 4EXPL: 2CVE-2006-3897 – Microsoft Internet Explorer 6 - NMSA.ASFSourceMediaDescription Stack Overflow
https://notcve.org/view.php?id=CVE-2006-3897
Stack overflow in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (application crash) by creating an NMSA.ASFSourceMediaDescription.1 ActiveX object with a long dispValue property. Desbordamiento de búfer basado en pila en Microsoft Internet Explorer 6 sobre Windows 2000 permite a atacantes remotos provocar denegación de servicio (caida de aplicación) a través de la creación de un objeto ActiveX NMSA.ASFSourceMediaDescription.1 con una propiedad dispValue. • https://www.exploit-db.com/exploits/28259 http://browserfun.blogspot.com/2006/07/mobb-23-nmsaasfsourcemediadescription.html http://www.osvdb.org/27232 http://www.securityfocus.com/bid/19114 http://www.vupen.com/english/advisories/2006/2953 https://exchange.xforce.ibmcloud.com/vulnerabilities/27930 • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 52%CPEs: 4EXPL: 2CVE-2006-3899 – Microsoft Internet Explorer 6 - String To Binary Function Denial of Service
https://notcve.org/view.php?id=CVE-2006-3899
Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the stringToBinary function of the CEnroll.CEnroll.2 ActiveX object with a long second argument, which triggers an invalid memory access inside the SysAllocStringLen function. Microsoft Internet Explorer 6.0 en Windows XP SP2 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) llamando a la función stringToBinary del objeto ActiveX CEnroll.CEnroll.2 con un segundo argumento largo, lo cual dispara un acceso a memoria inválido dentro de la función SysAllocStringLen. • https://www.exploit-db.com/exploits/28252 http://browserfun.blogspot.com/2006/07/mobb-21-cenroll-stringtobinary.html http://www.osvdb.org/27230 http://www.securityfocus.com/bid/19102 http://www.vupen.com/english/advisories/2006/2916 https://exchange.xforce.ibmcloud.com/vulnerabilities/27884 •
CVSS: 2.6EPSS: 5%CPEs: 4EXPL: 3CVE-2006-3729 – Microsoft Internet Explorer 6 - DataSourceControl Denial of Service
https://notcve.org/view.php?id=CVE-2006-3729
DataSourceControl in Internet Explorer 6 on Windows XP SP2 with Office installed allows remote attackers to cause a denial of service (crash) via a large negative integer argument to the getDataMemberName method of a OWC11.DataSourceControl.11 object, which leads to an integer overflow and a null dereference. DataSourceControl en Internet Explorer 6 sobre Windows XP SP2 con Office instalado permite a atacantes remotos provocar denegación de servicio (caida) a través de un argumento entero largo negativo en el método getDataMemberName de un objeto OWC11.DataSourceControl.11, el cual lleva a un desbordamiento de entero y una referencia NULL. • https://www.exploit-db.com/exploits/28244 http://browserfun.blogspot.com/2006/07/mobb-19-datasourcecontrol.html http://www.osvdb.org/27111 http://www.securityfocus.com/bid/19069 http://www.vupen.com/english/advisories/2006/2883 https://exchange.xforce.ibmcloud.com/vulnerabilities/27803 •