National Cyber Awareness System

Vulnerability Summary for CVE-2006-0020

Overview

An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#312956

Name: VU#312956

Type: Advisory; Patch Information

Hyperlink:http://www.kb.cert.org/vuls/id/312956

US-CERT Technical Alert: TA06-045A

Name: TA06-045A

Type: Advisory

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-045A.html

External Source: BID

Name: 16516

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/16516

External Source: MS

Name: MS06-004

Type: Patch Information

Hyperlink:http://www.microsoft.com/technet/security/bulletin/ms06-004.mspx

External Source: SECUNIA

Name: 18729

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18729

External Source: VUPEN

Name: ADV-2006-0469

Hyperlink:http://www.vupen.com/english/advisories/2006/0469

External Source: OSVDB

Name: 22976

Hyperlink:http://www.osvdb.org/22976

External Source: CONFIRM

Name: http://www.microsoft.com/technet/security/advisory/913333.mspx

Type: Advisory

Hyperlink:http://www.microsoft.com/technet/security/advisory/913333.mspx

External Source: SECUNIA

Name: 18912

Type: Advisory

Hyperlink:http://secunia.com/advisories/18912

External Source: MLIST

Name: [funsec] 20060110 Another WMF flaw without a Microsoft patch

Type: Advisory; Exploit

Hyperlink:http://linuxbox.org/pipermail/funsec/2006-January/002828.html

US Government Resource: oval:org.mitre.oval:def:1638

Name: oval:org.mitre.oval:def:1638

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1638

References to Check Content

Identifier:oval:org.mitre.oval:def:1638

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:1638