Description
Heap-based buffer overflow in HTML Help ActiveX control (hhctrl.ocx) in Microsoft Internet Explorer 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code by repeatedly setting the Image field of an Internet.HHCtrl.1 object to certain values, possibly related to improper escaping and long strings.
References (14)
Core 14
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1016434
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-046
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/159220
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2634
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/27573
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/442733/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/26835
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/2635
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA06-220A.html
Vendor Advisory x_refsource_misc
http://www.tippingpoint.com/security/advisories/TSRT-06-08.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/20906
Various Sources x_refsource_misc
http://browserfun.blogspot.com/2006/07/mobb-2-internethhctrl-image-property.html
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/18769
Scores
EPSS
0.3527
EPSS Percentile
98.3%
Details
Status
published
Products (1)
microsoft/internet_explorer
6.0
Published
Jul 06, 2006
Tracked Since
Feb 18, 2026