Vulnerability Intelligence Report
CVE-2004-0842
Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
EPSS Probability:56.61%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| avaya | ip600_media_servers | all |
| microsoft | ie | 6.0 |
| microsoft | internet_explorer | 5.0.1, 5.5, 6.0 |
| avaya | definity_one_media_server | all |
| avaya | s3400 | all |
| avaya | s8100 | all |
| avaya | modular_messaging_message_storage_server | 1.1, 2.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
56.607%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2004-09-08T00:00:00 |
| Published | 2004-09-14T04:00:00 |
| Patch Date | 2004-07-23 |
| Last Updated | 2024-08-08T00:31:47 |
Community Chatter & Buzz