CVE-2006-3899: Medium severity Microsoft Internet Explorer vulnerability

Published Jul 27, 2006

Updated

Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the stringToBinary function of the CEnroll.CEnroll.2 ActiveX object with a long second argument, which triggers an invalid memory access inside the SysAllocStringLen function.

Affected Software

4 affected components

Microsoft Internet Explorer=6.0

Microsoft Internet Explorer=6.0-sp1

Microsoft Internet Explorer=6.0-sp2

Microsoft Windows XP=sp2

Event History

Jul 27, 2006

CVE Published

11:04 AM

Data Sourced

11:04 AM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3899?

CVE-2006-3899 has been classified as a denial of service vulnerability.

How does CVE-2006-3899 exploit work?

CVE-2006-3899 exploits a flaw in the stringToBinary function of the CEnroll.CEnroll.2 ActiveX object, leading to an application crash.

Which versions of Internet Explorer are affected by CVE-2006-3899?

CVE-2006-3899 affects Internet Explorer 6.0, including its SP1 and SP2 versions.

What operating system is impacted by CVE-2006-3899?

CVE-2006-3899 impacts Microsoft Windows XP SP2 when using the affected versions of Internet Explorer.

Is there a workaround for CVE-2006-3899?

There is no specific workaround for CVE-2006-3899; updating the affected software is the recommended approach.