CVE-2004-0842

high Microsoft
CVSS v3 Base Score
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS Score
84.3%
Exploitation probability in 30 days
Top 1% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
P
Integrity
P
Availability
P
Published: December 23, 2004 (7812 days ago)
Last Modified: April 16, 2026
Vendor: Microsoft
Source: NVD

Description

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."

CWE

NVD-CWE-Other

Affected Products

avaya ip600 media serversmicrosoft iemicrosoft internet exploreravaya definity one media serveravaya s3400avaya s8100avaya modular messaging message storage server

References

🔗 marc.info 🔗 marc.info 🔗 marc.info 🔗 secunia.com 🔗 www.ciac.org