CVE-2003-0469 Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via cut-and-pas...
HighCVSS 7.5
EPSS 44.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Buffer overflow in the HTML Converter (HTML32.cnv) on various Windows operating systems allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via cut-and-paste operation, as demonstrated in Internet Explorer 5.0 using a long "align" argument in an HR tag.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2000 | All versions | No fix listed |
| Microsoft windows 2003 server | = 64-bit | No fix listed |
| Microsoft windows 2003 server | = r2 | No fix listed |
| Microsoft windows 98 | All versions | No fix listed |
| Microsoft windows 98se | All versions | No fix listed |
| Microsoft windows me | All versions | No fix listed |
| Microsoft windows nt | = 4.0 | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
References
- 20030701 PoC for Internet Explorer >=5.0 buffer overflow (trivial exploit for hard case). mailing-list
- 20030625 Re: Internet Explorer >=5.0 : Buffer overflow mailing-list
- 20030622 Internet Explorer >=5.0 : Buffer overflow mailing-list
- CA-2003-14 third-party-advisory us-government-resource
- VU#823260 third-party-advisory us-government-resource
- 8016 vdb-entry
- MS03-023 vendor-advisory