PT-2006-4910 · Microsoft · Msn Messenger+2

Published 2006-08-10 · Updated 2018-10-17 · CVE-2006-4066

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows XP SP2

Description The issue allows context-dependent attackers to cause a denial of service, resulting in an application crash, via certain images that trigger a divide-by-zero error. This can be demonstrated using specific file types, such as .ico, .png, and .jpg files, which can cause applications like MSN Messenger and Internet Explorer to crash.

Recommendations For Microsoft Windows XP SP2, consider avoiding the use of potentially problematic image files until a resolution is provided. As a temporary workaround, restrict the handling of .ico, .png, and .jpg files in sensitive applications to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-4066

Affected Products

Internet Explorer

Msn Messenger

Windows Xp

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-4066 · Security Note
• http://securityfocus.com/archive/1/441548/100/100/threaded · Note
• http://securityfocus.com/bid/19301 · Note
• http://vupen.com/english/advisories/2006/3114 · Note
• http://securityfocus.com/archive/1/441875/100/0/threaded · Note
• http://securityfocus.com/bid/19221 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28183 · Note
• http://securityfocus.com/archive/1/441723/100/100/threaded · Note