CVE-2006-4066 - The Graphical Device Interface Plus library (gdiplus.dll) in Microsoft Windows XP SP2 allows context

CVE-2006-4066

Summary

The Graphical Device Interface Plus library (gdiplus.dll) in Microsoft Windows XP SP2 allows context-dependent attackers to cause a denial of service (application crash) via certain images that trigger a divide-by-zero error, as demonstrated by a (1) .ico file, (2) .png file that crashes MSN Messenger, and (3) .jpg file that crashes Internet Explorer. NOTE: another researcher has not been able to reproduce this issue.

References

Vulnerable Configurations

cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*

CVSS

Base:	2.6 (as of 17-10-2018 - 21:33)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:N/I:N/A:P

refmap via4

bid	19221 19301
bugtraq	20060728 Gdiplus.dll division by 0 20060731 Re: Gdiplus.dll division by 0 20060801 Re: Gdiplus.dll division by 0
vupen	ADV-2006-3114
xf	windows-gdiplus-dos(28183)

Last major update

17-10-2018 - 21:33

Published

10-08-2006 - 00:04

Last modified

17-10-2018 - 21:33