// For flags

CVE-2006-4868

Microsoft Internet Explorer (Windows XP SP2) - 'VML' Remote Buffer Overflow

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

4
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Stack-based buffer overflow in the Vector Graphics Rendering engine (vgx.dll), as used in Microsoft Outlook and Internet Explorer 6.0 on Windows XP SP2, and possibly other versions, allows remote attackers to execute arbitrary code via a Vector Markup Language (VML) file with a long fill parameter within a rect tag.

Desbordamiento de búfer basado en el motor Vector Graphics Rendering (vgx.dll), tal y como se usa en Microsoft Outlook e Internet Explorer 6.0 en Windows XP SP2 y posiblemente otras versiones permite a atacantes remotos ejecutar código de su elección mediante un fichero Vector Markup Language (VML) con un parámetro "fill" largo dentro de una etiqueta "rect".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-09-19 CVE Reserved
  • 2006-09-19 CVE Published
  • 2006-09-24 First Exploit
  • 2024-08-07 CVE Updated
  • 2024-08-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (25)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2000
Search vendor "Microsoft" for product "Windows 2000"
*sp4
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*-
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*x64
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*gold
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*-
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
6.0
Search vendor "Microsoft" for product "Internet Explorer" and version "6.0"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2000
Search vendor "Microsoft" for product "Windows 2000"
*sp4
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*-
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*itanium
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*x64
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*gold
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2003 Server
Search vendor "Microsoft" for product "Windows 2003 Server"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*-
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp1
Safe
Microsoft
Search vendor "Microsoft"
Outlook
Search vendor "Microsoft" for product "Outlook"
2003
Search vendor "Microsoft" for product "Outlook" and version "2003"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows Xp
Search vendor "Microsoft" for product "Windows Xp"
*sp2
Safe
Microsoft
Search vendor "Microsoft"
Internet Explorer
Search vendor "Microsoft" for product "Internet Explorer"
5.0.1
Search vendor "Microsoft" for product "Internet Explorer" and version "5.0.1"
sp4
Affected
in Microsoft
Search vendor "Microsoft"
Windows 2000
Search vendor "Microsoft" for product "Windows 2000"
*sp4
Safe