PT-2005-5501 · Microsoft · Outlook Express+1

Published 2005-12-31 · Updated 2021-07-23 · CVE-2005-4840

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Outlook Express (affected versions not specified) Internet Explorer version 6

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL dereference and browser crash. This occurs when the OutlookExpress.AddressBook COM object is created, which is not intended for use within Internet Explorer.

Recommendations For Internet Explorer version 6, avoid using the Outlook Express Address Book control to prevent the denial of service. As a temporary workaround, consider disabling the creation of the OutlookExpress.AddressBook COM object within Internet Explorer until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2005-4840

Affected Products

Internet Explorer

Outlook Express

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-4840 · Security Note
• http://securityfocus.com/archive/1/470694/100/0/threaded · Note
• http://osvdb.org/26836 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34755 · Note
• http://browserfun.blogspot.com/2006/07/mobb-3-outlookexpressaddressbook_02.html · Note
• http://securityfocus.com/archive/1/391803 · Note