PT-2004-1904 · Microsoft · Internet Explorer

David Coomber

+1

·

Publicado

2004-09-14

·

Atualizado

2021-07-23

·

CVE-2004-0842

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: Internet Explorer versions 6.0 SP1 and earlier
Description: The issue allows remote attackers to cause a denial of service, resulting in an application crash due to memory corruption. This is achieved through certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows. An example of such a malformed CSS element is the "@;/*" string. The cause may be attributed to a missing comment terminator, potentially leading to an invalid length that triggers a large memory copy operation.
Recommendations: For Internet Explorer versions 6.0 SP1 and earlier, consider disabling the processing of CSS elements until a patch is available. Restrict access to potentially malicious web content to minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2004-0842

Produtos afetados

Internet Explorer