CVE-2006-1992 - mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause

CVE-2006-1992

Summary

mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Explorer, allows remote attackers to cause a denial of service (crash) via nested OBJECT tags, which trigger invalid pointer dereferences including NULL dereferences. NOTE: the possibility of code execution was originally theorized, but Microsoft has stated that this issue is non-exploitable.

References

Vulnerable Configurations

cpe:2.3:a:microsoft:internet_explorer:6.0.2900:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_explorer:6.0.2900:*:*:*:*:*:*:*

CVSS

Base:	2.6 (as of 23-07-2021 - 15:03)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:N/I:N/A:P

refmap via4

bid	17658
bugtraq	20060422 MSIE (mshtml.dll) OBJECT tag vulnerability
fulldisc	20060422 Re: MSIE (mshtml.dll) OBJECT tag vulnerability 20060423 MSIE (mshtml.dll) OBJECT tag vulnerability
osvdb	27475
sectrack	1016001 1016291
secunia	19762
sreason	781
vupen	ADV-2006-1507
xf	ie-object-memory-corruption(25978)

Last major update

23-07-2021 - 15:03

Published

25-04-2006 - 01:02

Last modified

23-07-2021 - 15:03