cbcvebase.
CVE-2006-1245
published 2006-03-17

CVE-2006-1245: Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via…

PriorityP350high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
61.82%
99.1th percentile
Buffer overflow in mshtml.dll in Microsoft Internet Explorer 6.0.2900.2180, and probably other versions, allows remote attackers to execute arbitrary code via an HTML tag with a large number of script action handlers such as onload and onmouseover, as demonstrated using onclick, aka the "Multiple Event Handler Memory Corruption Vulnerability."

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftie——

Detection & IOCsextracted from sources · hover to see the quote

filenamemshtml.dll↗
commandfor(s=''));i++)s+=s;↗
  • →Detect HTML pages containing an abnormally large number of script event handler attributes (e.g., onclick, onload, onmouseover) on a single tag, which is the trigger condition for the mshtml.dll buffer overflow. ↗
  • →Monitor for crashes or memory corruption events originating from mshtml.dll in Internet Explorer processes, particularly when processing pages with repeated event handler string concatenation patterns. ↗
  • ·Vulnerability is confirmed in IE 6.0.2900.2180 but other versions including IE 5.0.1 may also be affected; scope of affected versions is not fully bounded. ↗
  • ·Remote code execution has not been confirmed; only browser crash (DoS) is verified. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.