NetSight
IP …
high7.5Public exploit code

CVE-2004-0842

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corrup…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."

Affected products

VendorProductAffected versions
AvayaIp600 Media Servers
All versions
MicrosoftIe
Version 6.0
MicrosoftInternet Explorer
Versions 5.0.1, 5.5, 6.0
AvayaDefinity One Media Server
All versions
AvayaS3400
All versions
AvayaS8100
All versions
AvayaModular Messaging Message Storage Server
Versions 1.1, 2.0

References