Advisory: SB2006091403 - Multiple vulnerabilities in Microsoft Internet Explorer
Vulnerable component: Microsoft Internet Explorer
CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C
CWE-ID: CWE-119 - Memory corruption
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow within DirectAnimation Path ActiveX control (daxctle.ocx) when handling unexpected input. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
- Microsoft Internet Explorer - COM Object Remote Heap Overflow [Exploit-DB]
- Microsoft Internet Explorer - Daxctle.OCX KeyFrame Method Heap Buffer Overflow (MS06-067) (Metasploit) [Exploit-DB]