Description
Microsoft Internet Explorer 5.01 and 6.0 allow remote attackers to execute arbitrary code via malformed Content-Disposition and Content-Type header fields that cause the application for the spoofed file type to pass the file back to the operating system for handling rather than raise an error message, aka the second variant of the "Content Disposition" vulnerability.
References (4)
Core 4
Core References
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-023
Third Party Advisory mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-05/0126.html
Various Sources x_refsource_misc
http://www.lac.co.jp/security/english/snsadv_e/48_e.html
Vendor Advisory vdb-entry
x_refsource_xf
http://www.iss.net/security_center/static/9086.php
Scores
EPSS
0.1635
EPSS Percentile
96.7%
Details
Status
published
Products (2)
microsoft/internet_explorer
5.01 (3 CPE variants)
microsoft/internet_explorer
6.0
Published
May 29, 2002
Tracked Since
Feb 18, 2026