CVE-2005-3312
The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The HTML rendering engine in Microsoft Internet Explorer 6.0 allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML in corrupted images and other files such as .GIF, JPG, and WAV, which is rendered as HTML when the user clicks on the link, even though the web server response and file extension indicate that it should be treated as a different file type.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 11.89% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/internet explorer
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=113017003617987&w=2
- http://securityreason.com/securityalert/18
- http://www.computec.ch/download.php?view.683Exploit
- http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1746Exploit, Vendor Advisory
- http://www.securiteam.com/windowsntfocus/6F00B00EBY.htmlVendor Advisory
- http://marc.info/?l=bugtraq&m=113017003617987&w=2
- http://securityreason.com/securityalert/18
- http://www.computec.ch/download.php?view.683Exploit
- http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1746Exploit, Vendor Advisory
- http://www.securiteam.com/windowsntfocus/6F00B00EBY.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.