CVE-2006-3638

Microsoft Internet Explorer 5.01 and 6 - Remote Code Execution via Uninitialized COM Object Handling

Title source: llm

Description

Microsoft Internet Explorer 5.01 and 6 does not properly handle uninitialized COM objects, which allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code, as demonstrated by the Nth function in the DirectAnimation.DATuple ActiveX control, aka "COM Object Instantiation Memory Corruption Vulnerability."

References (11)

Core 11

Core References

US Government Resource third-party-advisory x_refsource_cert-vn

http://www.kb.cert.org/vuls/id/959049

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1016663

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-042

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://www.osvdb.org/27852

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A719

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/442728/100/0/threaded

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21396

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3212

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA06-220A.html

Vendor Advisory x_refsource_misc

http://www.tippingpoint.com/security/advisories/TSRT-06-09.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/19340

Scores

EPSS 0.3680

EPSS Percentile 98.3%

Details

CWE

CWE-119

Status published

Products (3)

microsoft/ie 6.0 sp1 (2 CPE variants)

microsoft/internet_explorer 5.0.1 (5 CPE variants)

microsoft/internet_explorer 6.0

Published Aug 08, 2006

Tracked Since Feb 18, 2026