CVE-2006-7066: Null Pointer Dereference
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an iframe, deleting the frame by setting its location.href to about:blank, then accessing a property of the object within the deleted frame, which triggers a NULL pointer dereference. NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-7066?
CVE-2006-7066 is classified as a denial of service vulnerability that can crash Microsoft Internet Explorer 6 on Windows XP SP2.
How does CVE-2006-7066 exploit work?
CVE-2006-7066 exploits the handling of objects inside iframes by deleting the frame and then accessing properties of the object within the deleted frame.
What versions of Internet Explorer are affected by CVE-2006-7066?
CVE-2006-7066 affects Internet Explorer versions 6.0, 6.0 with SP1, and 6.0 with SP2.
Is Microsoft Windows XP SP2 vulnerable to CVE-2006-7066?
Yes, Microsoft Windows XP SP2 is vulnerable to CVE-2006-7066 when using Internet Explorer.
How can I protect my system from CVE-2006-7066?
To protect against CVE-2006-7066, users should consider upgrading their web browser and operating system to versions that are no longer vulnerable.