20070128 Internet Explorer 7 ActiveX bgColor property NULL pointer dereference (DoS)mailing list
http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0547.html CVE-2007-0612
Microsoft Internet Explorer 5.0.1 - Multiple ActiveX Controls Denial of Service Vulnerabilities
Record summary
CVE-2007-0612 has a selected CVSS score of 7.8; EIP currently links 1 catalogued exploit.
Description
Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor, fgColor, linkColor, alinkColor, vlinkColor, or defaultCharset properties in the (1) giffile, (2) htmlfile, (3) jpegfile, (4) mhtmlfile, (5) ODCfile, (6) pjpegfile, (7) pngfile, (8) xbmfile, (9) xmlfile, (10) xslfile, or (11) wdfile objects in (a) mshtml.dll; or the (12) TriEditDocument.TriEditDocument or (13) TriEditDocument.TriEditDocument.1 objects in (b) triedit.dll, which cause a NULL pointer dereference.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBMicrosoft Internet Explorer 5.0.1 - Multiple ActiveX Controls Denial of Service VulnerabilitiesExploitDB exploitby Alexander SotirovNot analyzed1 file
References
920070129 Internet Explorer 7 ActiveX bgColor property NULL pointer dereference (DoS)mailing list
http://lists.grok.org.uk/pipermail/full-disclosure/2007-January/052057.html 32628vdb entry
http://osvdb.org/32628 2199Third-party advisory
http://securityreason.com/securityalert/2199 determina.com
http://www.determina.com/security.research/vulnerabilities/activex-bgcolor.html 20070129 Internet Explorer 7 ActiveX bgColor property NULL pointer dereference (DoS)mailing list
http://www.securityfocus.com/archive/1/458443/100/0/threaded 22288vdb entry
http://www.securityfocus.com/bid/22288 ie-activex-bgcolor-dos(31867)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/31867 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2007-0612