Executive Summary

Informations
Name	MS06-021	First vendor Publication	N/A
Vendor	Microsoft	Last vendor Modification	N/A
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Cumulative Security Update for Internet Explorer (916281)

CWE : Common Weakness Enumeration

%	Id	Name
29 %	CWE-94	Failure to Control Generation of Code ('Code Injection')
14 %	CWE-399	Resource Management Errors
14 %	CWE-264	Permissions, Privileges, and Access Controls
14 %	CWE-200	Information Exposure
14 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
14 %	CWE-20	Improper Input Validation

OVAL Definitions

 

Definition Id: oval:org.mitre.oval:def:1078
Oval ID:	oval:org.mitre.oval:def:1078
Title:	Exception Handling Memory Corruption Vulnerability (S03,SP1)
Description:	Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2218	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1135
Oval ID:	oval:org.mitre.oval:def:1135
Title:	COM Object Instantiation Memory Corruption Vulnerability (S03,SP1)
Description:	Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1303	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1167
Oval ID:	oval:org.mitre.oval:def:1167
Title:	MHT Memory Corruption Vulnerability (S03,SP1)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2385	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1414
Oval ID:	oval:org.mitre.oval:def:1414
Title:	HTML Decoding Memory Corruption Vulnerability (Win2K)
Description:	Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2382	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1423
Oval ID:	oval:org.mitre.oval:def:1423
Title:	MHT Memory Corruption Vulnerability (WinS03)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2385	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:1478
Oval ID:	oval:org.mitre.oval:def:1478
Title:	Address Bar Spoofing Vulnerability (WinS03)
Description:	Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2384	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:1556
Oval ID:	oval:org.mitre.oval:def:1556
Title:	CSS Cross-Domain Information Disclosure Vulnerability (S03,SP1)
Description:	Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-4089	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1567
Oval ID:	oval:org.mitre.oval:def:1567
Title:	Address Bar Spoofing Vulnerability (Win2K)
Description:	Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2384	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1600
Oval ID:	oval:org.mitre.oval:def:1600
Title:	Flash Address Bar Spoofing Vulnerability (Win2K)
Description:	Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1626	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1604
Oval ID:	oval:org.mitre.oval:def:1604
Title:	Flash Address Bar Spoofing Vulnerability (64-bit XP)
Description:	Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1626	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1609
Oval ID:	oval:org.mitre.oval:def:1609
Title:	MHT Memory Corruption Vulnerability (WinXP,SP2)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2385	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1621
Oval ID:	oval:org.mitre.oval:def:1621
Title:	HTML Decoding Memory Corruption Vulnerability (2K/XP)
Description:	Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2382	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1646
Oval ID:	oval:org.mitre.oval:def:1646
Title:	Address Bar Spoofing Vulnerability (64-bit XP)
Description:	Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2384	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1665
Oval ID:	oval:org.mitre.oval:def:1665
Title:	MHT Memory Corruption Vulnerability (2K/XP)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2385	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1686
Oval ID:	oval:org.mitre.oval:def:1686
Title:	Address Bar Spoofing Vulnerability (XP,SP2)
Description:	Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2384	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1728
Oval ID:	oval:org.mitre.oval:def:1728
Title:	Exception Handling Memory Corruption Vulnerability (WinS03)
Description:	Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2218	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:1752
Oval ID:	oval:org.mitre.oval:def:1752
Title:	HTML Decoding Memory Corruption Vulnerability (WinS03)
Description:	Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2382	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:1765
Oval ID:	oval:org.mitre.oval:def:1765
Title:	Exception Handling Memory Corruption Vulnerability (2K/XP)
Description:	Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2218	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1767
Oval ID:	oval:org.mitre.oval:def:1767
Title:	COM Object Instantiation Memory Corruption Vulnerability (Win2K)
Description:	Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1303	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1768
Oval ID:	oval:org.mitre.oval:def:1768
Title:	Exception Handling Memory Corruption Vulnerability (XP,SP2)
Description:	Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2218	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1775
Oval ID:	oval:org.mitre.oval:def:1775
Title:	Address Bar Spoofing Vulnerability (2K/XP)
Description:	Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2384	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1788
Oval ID:	oval:org.mitre.oval:def:1788
Title:	Address Bar Spoofing Vulnerability (S03,SP1)
Description:	Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to conduct spoofing and phishing attacks by using a modal browser window in a way that preserves the original address bar and trusted UI of a trusted site, even after the browser has been navigated to a malicious site, aka the "Address Bar Spoofing Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2384	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1800
Oval ID:	oval:org.mitre.oval:def:1800
Title:	CSS Cross-Domain Information Disclosure Vulnerability (Win2K)
Description:	Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-4089	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1806
Oval ID:	oval:org.mitre.oval:def:1806
Title:	Flash Address Bar Spoofing Vulnerability (WinS03)
Description:	Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1626	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:1821
Oval ID:	oval:org.mitre.oval:def:1821
Title:	ActiveX Control Memory Corruption Vulnerability (S03,SP1)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2383	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1830
Oval ID:	oval:org.mitre.oval:def:1830
Title:	COM Object Instantiation Memory Corruption Vulnerability (XP,SP2)
Description:	Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1303	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1838
Oval ID:	oval:org.mitre.oval:def:1838
Title:	CSS Cross-Domain Information Disclosure Vulnerability (XP,SP2)
Description:	Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-4089	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1842
Oval ID:	oval:org.mitre.oval:def:1842
Title:	Flash Address Bar Spoofing Vulnerability (XP,SP2)
Description:	Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1626	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1845
Oval ID:	oval:org.mitre.oval:def:1845
Title:	Exception Handling Memory Corruption Vulnerability (Win2k)
Description:	Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2218	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1862
Oval ID:	oval:org.mitre.oval:def:1862
Title:	HTML Decoding Memory Corruption Vulnerability (64-bit XP)
Description:	Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2382	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1881
Oval ID:	oval:org.mitre.oval:def:1881
Title:	Flash Address Bar Spoofing Vulnerability (2K/XP)
Description:	Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1626	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1891
Oval ID:	oval:org.mitre.oval:def:1891
Title:	ActiveX Control Memory Corruption Vulnerability (XP,SP2)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2383	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1906
Oval ID:	oval:org.mitre.oval:def:1906
Title:	HTML Decoding Memory Corruption Vulnerability (S03,SP1)
Description:	Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2382	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1911
Oval ID:	oval:org.mitre.oval:def:1911
Title:	MHT Memory Corruption Vulnerability (Win2K)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2385	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1914
Oval ID:	oval:org.mitre.oval:def:1914
Title:	CSS Cross-Domain Information Disclosure Vulnerability (2K/XP)
Description:	Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-4089	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1916
Oval ID:	oval:org.mitre.oval:def:1916
Title:	MHT Memory Corruption Vulnerability (64-bit XP)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2385	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1918
Oval ID:	oval:org.mitre.oval:def:1918
Title:	Flash Address Bar Spoofing Vulnerability (S03,SP1)
Description:	Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-opening the window to a malicious Shockwave Flash application, then changing the window location back to a trusted URL while the Flash application is still loading. NOTE: this is a different vulnerability than CVE-2006-1192.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1626	Version:	4
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND Win2K/XP/2003 service pack 1 is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1924
Oval ID:	oval:org.mitre.oval:def:1924
Title:	ActiveX Control Memory Corruption Vulnerability (Win2K)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2383	Version:	8
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows 2000 Service Pack 4 (or later) is installed Windows 2000 is installed AND Win2K/XP/2003 service pack 4 (or later) is installed AND Internet Explorer 5.01 Service Pack 4 is installed AND the version of mshtml.dll is less than 5.0.3841.1900

 

Definition Id: oval:org.mitre.oval:def:1928
Oval ID:	oval:org.mitre.oval:def:1928
Title:	COM Object Instantiation Memory Corruption Vulnerability (64-bit XP)
Description:	Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1303	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1931
Oval ID:	oval:org.mitre.oval:def:1931
Title:	HTML Decoding Memory Corruption Vulnerability (XP,SP2)
Description:	Heap-based buffer overflow in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via crafted UTF-8 encoded HTML that results in size discrepancies during conversion to Unicode, aka "HTML Decoding Memory Corruption Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2382	Version:	5
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003/Vista/2008 Service Pack 2 is installed AND the version of mshtml.dll is less than 6.0.2900.2912

 

Definition Id: oval:org.mitre.oval:def:1944
Oval ID:	oval:org.mitre.oval:def:1944
Title:	ActiveX Control Memory Corruption Vulnerability (2K/XP)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2383	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1949
Oval ID:	oval:org.mitre.oval:def:1949
Title:	ActiveX Control Memory Corruption Vulnerability (WinS03)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2383	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:1961
Oval ID:	oval:org.mitre.oval:def:1961
Title:	Exception Handling Memory Corruption Vulnerability(64-bit XP)
Description:	Unspecified vulnerability in Internet Explorer 6.0 on Microsoft Windows XP SP2 allows remote attackers to execute arbitrary code via "exceptional conditions" that trigger memory corruption, as demonstrated using an exception handler and nested object tags, a variant of CVE-2006-1992.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2218	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1973
Oval ID:	oval:org.mitre.oval:def:1973
Title:	COM Object Instantiation Memory Corruption Vulnerability (2K/XP)
Description:	Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1303	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Win2K or XP,SP1 is installed Windows 2000 is installed OR Windows XP 32-bit SP1 is installed Windows XP 32-bit edition is installed Windows XP is installed AND 32-Bit version of Windows is installed AND Win2K/XP/2003 service pack 1 is installed AND Internet Explorer 6 Service Pack 1 is installed AND the version of mshtml.dll is less than 6.0.2800.1555

 

Definition Id: oval:org.mitre.oval:def:1977
Oval ID:	oval:org.mitre.oval:def:1977
Title:	CSS Cross-Domain Information Disclosure Vulnerability (64-bit XP)
Description:	Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-4089	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:1985
Oval ID:	oval:org.mitre.oval:def:1985
Title:	CSS Cross-Domain Information Disclosure Vulnerability (WinS03)
Description:	Microsoft Internet Explorer allows remote attackers to bypass cross-domain security restrictions and obtain sensitive information by using the @import directive to download files from other domains that are not valid Cascading Style Sheets (CSS) files, as demonstrated using Google Desktop, aka "CSSXSS" and "CSS Cross-Domain Information Disclosure Vulnerability."
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2005-4089	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

 

Definition Id: oval:org.mitre.oval:def:2009
Oval ID:	oval:org.mitre.oval:def:2009
Title:	ActiveX Control Memory Corruption Vulnerability (64-bit XP)
Description:	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allows remote attackers to execute arbitrary code via "unexpected data" related to "parameter validation" in the DXImageTransform.Microsoft.Light ActiveX control, which causes Internet Explorer to crash in a way that enables the code execution.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-2383	Version:	4
Platform(s):	Microsoft Windows XP	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows XP is installed AND Win2K/XP/2003 service pack 1 is installed AND 64-Bit version of Windows is installed AND the version of mshtml.dll is less than 6.0.3790.2706

 

Definition Id: oval:org.mitre.oval:def:2017
Oval ID:	oval:org.mitre.oval:def:2017
Title:	COM Object Instantiation Memory Corruption Vulnerability (WinS03)
Description:	Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2006-1303	Version:	5
Platform(s):	Microsoft Windows Server 2003	Product(s):	Microsoft Internet Explorer
Definition Synopsis:
Windows Server 2003 is installed AND NOT Win2K/XP/2003 is patched AND the version of mshtml.dll is less than 6.0.3790.536

CPE : Common Platform Enumeration

Type	Description	Count
Application	Microsoft Ie cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:ie:6.0:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:ie:5.0.1:*:windows_nt_4.0:*:*:*:*:* cpe:2.3:a:microsoft:ie:5.0.1:*:windows_98:*:*:*:*:* cpe:2.3:a:microsoft:ie:5.0.1:*:windows_2000:*:*:*:*:* cpe:2.3:a:microsoft:ie:5.0.1:*:windows_95:*:*:*:*:*	6
Application	Microsoft Internet Explorer cpe:2.3:a:microsoft:internet_explorer:6.0.2900:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6.0:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6.0:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6.0:-:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:-:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:beta1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:sp3:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_sp2_itanium:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:windows_xp_professional_x64_edition:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_x64_edition:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_sp2:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:windows_server_2003_x64_edition_sp2:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:*:windows_xp_professional_x64_edition_sp2:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:6:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.4807.2300:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.4522.1800:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.4308.2900:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.4134.0600:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.4134.0100:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.4030.2400:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.50.3825.1300:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:preview:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.5:-:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.2.3:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.01:sp3:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.3700.1000:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.3502.1000:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.3315.1000:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.3314.2101:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.3105.0106:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.3103.1000:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2920.0000:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2919.800:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2919.6307:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2919.3800:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2614.3500:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2516.1900:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2314.1003:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.2014.0216:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.0910.1309:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.00.0518.10:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:-:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.72.3612.1713:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.72.3110.8:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.72.2106.8:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.71.544:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.71.1712.6:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.71.1008.3:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.70.1300:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.70.1215:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.70.1158:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.70.1155:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.5:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.40.520:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.40.308:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.01:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.01:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.0.1:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.0.1:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:4.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:3.2:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:3.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:3.0:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*	87

Open Source Vulnerability Database (OSVDB)

Id	Description
27475	Microsoft IE Nested Objects Exception Handler Unspecified Memory Corruption Internet Explorer contains a flaw that may allow a malicious user to execute arbitrary code. This issue is caused by a memory corruption error within the handling of certain "exceptional conditions". The error occurs in mshtml.dll when the browser encounters a set of nested OBJECT tags which triggers a NULL dereference.
26446	Microsoft IE Multipart HTML File Save Memory Corruption Microsoft Internet Explorer contains a flaw that allows remote code execution via a crafted web page that triggers memory corruption when it is saved as a multipart HTML (.mht) file.
26445	Microsoft IE Modal Browser Window Address Bar Spoofing Microsoft Internet Explorer contains a flaw that may allow a malicious user to spoof the information in the address bar in a way that preserves the original address bar and trusted UI of a trusted site even after the browser has been navigated to a malicious site. It is possible that the flaw may allow phishing attacks or loss of integrity.
26444	Microsoft IE DXImageTransform.Microsoft.Light ActiveX Arbitrary Code Execution Microsoft IE contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered due to an error in the parameter validation in the DXImageTransform.Microsoft.Light ActiveX control. It is possible that the flaw may allow arbitrary code execution when a user e.g. visits a malicious web site resulting in a loss of integrity.
26443	Microsoft IE UTF-8 Encoded HTML Overflow A remote overflow exists in Microsoft IE. Internet Explorer fails to translate UTF-8 characters to Unicode resulting in an encoded HTML overflow. With a specially crafted request, an attacker can cause remote code execution resulting in a loss of integrity.
26442	Microsoft IE Wmm2fxa.dll DXImageTransform COM Object Memory Corruption Windows contains an unspecified flaw in Internet Explorer related to the handling of ActiveX controls by the Wmm2fxa.ddl component that may allow an attacker to execute arbitrary code. No further details have been provided.
24966	Microsoft IE object Tag Memory Corruption Arbitrary Code Execution
24465	Microsoft IE Window Loading Race Condition Address Bar Spoofing
21532	Microsoft IE CSS @import Directive Cross Domain Information Disclosure

Snort® IPS/IDS

Date	Description
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.MMSpecialEffect1Input ... RuleID : 6687 - Revision : 15 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.MMSpecialEffect2Inputs... RuleID : 6686 - Revision : 17 - Type : BROWSER-PLUGINS
2014-01-10	DXImageTransform.Microsoft.MMSpecialEffect2Inputs ActiveX CLSID unicode access RuleID : 6685 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.MMSpecialEffectInplace... RuleID : 6684 - Revision : 17 - Type : BROWSER-PLUGINS
2014-01-10	DXImageTransform.Microsoft.MMSpecialEffect1Input ActiveX CLSID unicode access RuleID : 6683 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.MMSpecialEffect2Inputs... RuleID : 6682 - Revision : 15 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.MMSpecialEffect1Input ... RuleID : 6681 - Revision : 17 - Type : BROWSER-PLUGINS
2014-01-10	Windows Media Transform Effects ActiveX CLSID unicode access RuleID : 6680 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10	DXImageTransform.Microsoft.Light ActiveX function call access RuleID : 6519 - Revision : 4 - Type : WEB-CLIENT
2014-01-10	DXImageTransform.Microsoft.Light ActiveX CLSID unicode access RuleID : 6518 - Revision : 6 - Type : WEB-ACTIVEX
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.Light ActiveX clsid ac... RuleID : 6517 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer DXImageTransform.Microsoft.Light ActiveX function... RuleID : 6516 - Revision : 11 - Type : BROWSER-PLUGINS
2014-01-23	Microsoft Internet Explorer DXImageTransform.Microsoft.MMSpecialEffectInplace... RuleID : 29037 - Revision : 3 - Type : BROWSER-PLUGINS
2014-01-10	Microsoft Internet Explorer address bar spoofing attempt RuleID : 28663 - Revision : 5 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer address bar spoofing attempt RuleID : 28662 - Revision : 5 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer address bar spoofing attempt RuleID : 17726 - Revision : 14 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CSS import cross-domain restriction bypass attempt RuleID : 17312 - Revision : 9 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer CSS import cross-domain restriction bypass attempt RuleID : 17311 - Revision : 6 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer HTML Decoding memory corruption attempt RuleID : 16032 - Revision : 12 - Type : BROWSER-IE
2014-01-10	Microsoft Internet Explorer nested object tag memory corruption attempt RuleID : 16031 - Revision : 13 - Type : BROWSER-IE

Nessus® Vulnerability Scanner

Date	Description
2006-06-13	Name : Arbitrary code can be executed on the remote host through the web client. File : smb_nt_ms06-021.nasl - Type : ACT_GATHER_INFO

Alert History

Date	Informations
2014-02-17 11:45:22	Multiple Updates
2014-01-23 21:20:30	Multiple Updates
2014-01-19 21:29:58	Multiple Updates