CVE-2004-2434 Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (browser crash) via a link with "::{" (colon colon left brace), which triggers a null dereference when the user...
MediumCVSS 5.0
EPSS 32.8%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (browser crash) via a link with "::{" (colon colon left brace), which triggers a null dereference when the user attempts to save the link using "Save As" and Internet Explorer prepares an error message with an attacker-controlled format string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft ie | = 6.0-sp1 | No fix listed |
References
- 20040614 Internet Explorer Remote Null Pointer Crash(mshtml.dll) exploit mailing-list vendor-advisory
- 20040615 RE: Internet Explorer Remote Null Pointer Crash(mshtml.dll) mailing-list
- 20040728 Re: Internet Explorer Remote Null Pointer Crash(mshtml.dll) mailing-list
- 1010491 exploit vdb-entry vendor-advisory
- 8335 exploit vdb-entry
- www.securiteam.com exploit vendor-advisory
- ie-null-pointer-dos(16420) vdb-entry