CVE-2006-1303
Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 38.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 38.01% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/ie · microsoft/internet explorer
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/20595Vendor Advisory
- http://securitytracker.com/id?1016291
- http://www.kb.cert.org/vuls/id/959049US Government Resource
- http://www.osvdb.org/26442
- http://www.securityfocus.com/archive/1/437041/100/0/threaded
- http://www.securityfocus.com/bid/18328Patch
- http://www.vupen.com/english/advisories/2006/2319Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-06-018.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-021
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26774
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1135
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1767
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1830
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1928
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1973
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2017
- http://secunia.com/advisories/20595Vendor Advisory
- http://securitytracker.com/id?1016291
- http://www.kb.cert.org/vuls/id/959049US Government Resource
- http://www.osvdb.org/26442
- http://www.securityfocus.com/archive/1/437041/100/0/threaded
- http://www.securityfocus.com/bid/18328Patch
- http://www.vupen.com/english/advisories/2006/2319Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-06-018.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-021
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26774
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1135
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1767
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1830
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1928
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.