CVE-2005-4717
Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Internet Explorer 6.0 on Windows NT 4.0 SP6a, Windows 2000 SP4, Windows XP SP1, Windows XP SP2, and Windows Server 2003 SP1 allows remote attackers to cause a denial of service (client crash) via a certain combination of a malformed HTML file and a CSS file that triggers a null dereference, probably related to rendering of a DIV element that contains a malformed IMG tag, as demonstrated by IEcrash.htm and IEcrash.rar.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 16.32% probability · 97th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/ie · microsoft/internet explorer · microsoft/windows 2000 · microsoft/windows 2003 server · microsoft/windows nt · microsoft/windows xp
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0673.htmlExploit
- http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0127.html
- http://www.securityfocus.com/bid/15268Exploit
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0673.htmlExploit
- http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0127.html
- http://www.securityfocus.com/bid/15268Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.