Vulnerability Name:

CVE-2006-1303 (CCN-26774)

Assigned:2006-06-13
Published:2006-06-13
Updated:2021-07-23
Summary:Multiple unspecified vulnerabilities in Microsoft Internet Explorer 5.01 SP4 and 6 SP1 and earlier allow remote attackers to execute arbitrary code by instantiating certain COM objects from Wmm2fxa.dll as ActiveX controls including (1) DXImageTransform.Microsoft.MMSpecialEffect1Input, (2) DXImageTransform.Microsoft.MMSpecialEffect1Input.1, (3) DXImageTransform.Microsoft.MMSpecialEffect2Inputs, (4) DXImageTransform.Microsoft.MMSpecialEffect2Inputs.1, (5) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input, and (6) DXImageTransform.Microsoft.MMSpecialEffectInplace1Input.1, which causes memory corruption during garbage collection.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2006-1303

Source: CCN
Type: SA20595
Microsoft Internet Explorer Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
20595

Source: CCN
Type: SECTRACK ID: 1016291
Microsoft Internet Explorer Multiple Memory and Access Control Errors Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1016291

Source: CCN
Type: ASA-2006-126
Windows Security Updates for June 2006 - (MS06-021 - MS06-032)

Source: CCN
Type: US-CERT VU#959049
Multiple COM objects cause memory corruption in Microsoft Internet Explorer

Source: CERT-VN
Type: US Government Resource
VU#959049

Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)

Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)

Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)

Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)

Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)

Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)

Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)

Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)

Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)

Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)

Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)

Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)

Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)

Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)

Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)

Source: OSVDB
Type: UNKNOWN
26442

Source: CCN
Type: OSVDB ID: 26442
Microsoft IE Wmm2fxa.dll DXImageTransform COM Object Memory Corruption

Source: BUGTRAQ
Type: UNKNOWN
20060613 ZDI-06-018: Microsoft Internet Explorer DXImageTransform ActiveX Memory Corruption Vulnerability

Source: BID
Type: Patch
18328

Source: CCN
Type: BID-18328
Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability Variant

Source: VUPEN
Type: Vendor Advisory
ADV-2006-2319

Source: MISC
Type: UNKNOWN
http://www.zerodayinitiative.com/advisories/ZDI-06-018.html

Source: CCN
Type: Internet Security Systems Protection Alert June 13, 2006
Cumulative Security Update for Internet Explorer for June 2006

Source: MS
Type: UNKNOWN
MS06-021

Source: XF
Type: UNKNOWN
ie-wmm2fxadll-execute-code(26774)

Source: XF
Type: UNKNOWN
ie-wmm2fxadll-execute-code(26774)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1135

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1767

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1830

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1928

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:1973

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:2017

Source: CCN
Type: ZDI-06-018
Microsoft Internet Explorer DXImageTransform ActiveX Memory Corruption Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:ie:5.0.1:*:windows_2000:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:5.0.1:*:windows_95:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:5.0.1:*:windows_98:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:5.0.1:*:windows_nt_4.0:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:ie:6.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.01:sp4:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_xp:-:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server::x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:xp:sp2:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:-::~~~~itanium~:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows:2003_server:sp1_itanium:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:1973
    V
    		COM Object Instantiation Memory Corruption Vulnerability (2K/XP)
    2014-02-24
    oval:org.mitre.oval:def:1767
    V
    		COM Object Instantiation Memory Corruption Vulnerability (Win2K)
    2014-02-24
    oval:org.mitre.oval:def:1135
    V
    		COM Object Instantiation Memory Corruption Vulnerability (S03,SP1)
    2011-05-16
    oval:org.mitre.oval:def:2017
    V
    		COM Object Instantiation Memory Corruption Vulnerability (WinS03)
    2011-05-16
    oval:org.mitre.oval:def:1830
    V
    		COM Object Instantiation Memory Corruption Vulnerability (XP,SP2)
    2011-05-16
    oval:org.mitre.oval:def:1928
    V
    		COM Object Instantiation Memory Corruption Vulnerability (64-bit XP)
    2011-05-16
    BACK
    microsoft ie 5.0.1
    microsoft internet explorer 5.0.1
    microsoft internet explorer 5.0.1 sp3
    microsoft internet explorer 5.0.1 sp4
    microsoft ie 5.0.1
    microsoft internet explorer 6.0
    microsoft ie 6.0 sp1
    microsoft internet explorer 5.0.1 sp1
    microsoft internet explorer 5.0.1 sp2
    microsoft ie 5.0.1
    microsoft ie 5.0.1
    microsoft ie 6.0
    microsoft ie 6.0 sp1
    microsoft ie 5.01 sp4
    microsoft windows xp - sp1
    microsoft windows 2000 - sp4
    microsoft windows 2003_server
    microsoft windows xp sp2
    microsoft windows 2003 server -
    microsoft windows 2003_server sp1
    microsoft windows 2003_server sp1_itanium