CVE-2003-1048
HIGH severity · CVSS 7.8 · Double free
7.8CVSS HIGH
Summary
Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)27%
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-025 ↗
Additional information
- NVD record
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-025Patch
- http://www.securityfocus.com/bid/8530Advisory
- http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009445.html
- http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009473.html
- http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009506.html
- http://www.ciac.org/ciac/bulletins/o-191.shtml
- http://www.kb.cert.org/vuls/id/685364Advisory
- http://www.us-cert.gov/cas/techalerts/TA04-212A.htmlAdvisory