Unscored severity · published Aug 19, 2005
CVE-2005-2127
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with…
–
CVSS
63.2%
EPSS
No
On KEV
Description
Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not intended for use within Internet Explorer, as originally demonstrated using the (1) DDS Library Shape Control (Msdds.dll) COM object, and other objects including (2) Blnmgrps.dll, (3) Ciodm.dll, (4) Comsvcs.dll, (5) Danim.dll, (6) Htmlmarq.ocx, (7) Mdt2dd.dll (as demonstrated using a heap corruption attack with uninitialized memory), (8) Mdt2qd.dll, (9) Mpg4ds32.ax, (10) Msadds32.ax, (11) Msb1esen.dll, (12) Msb1fren.dll, (13) Msb1geen.dll, (14) Msdtctm.dll, (15) Mshtml.dll, (16) Msoeacct.dll, (17) Msosvfbr.dll, (18) Mswcrun.dll, (19) Netshell.dll, (20) Ole2disp.dll, (21) Outllib.dll, (22) Psisdecd.dll, (23) Qdvd.dll, (24) Repodbc.dll, (25) Shdocvw.dll, (26) Shell32.dll, (27) Soa.dll, (28) Srchui.dll, (29) Stobject.dll, (30) Vdt70.dll, (31) Vmhelper.dll, and (32) Wbemads.dll, aka a variant of the "COM Object Instantiation Memory Corruption vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)63.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Office · Microsoft
2000; 2000; 2000; 2000; 2000; 2000; +4 more · source: NVD
NF
.net Framework · Microsoft
1.1; 1.1; 1.1; 1.1 · source: NVD
CD
Catalyst Driver · Ati
All versions, or not specified · source: NVD
PR
Project · Microsoft
98; 2000; 2002; 2002; 2003; 2003 · source: NVD
VI
Visio · Microsoft
2000; 2002; 2002; 2002; 2002; 2002; +5 more · source: NVD
VS
Visual Studio .net · Microsoft
2002; 2003; 2003; gold; gold; gold; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2127
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2127
Third Party Advisory
http://isc.sans.org/diary.php?date=2005-08-18
Patch
http://secunia.com/advisories/16480
Permissions Required
http://secunia.com/advisories/17172
Permissions Required
http://secunia.com/advisories/17223
Permissions Required
http://secunia.com/advisories/17509
Third Party Advisory
http://securityreason.com/securityalert/72
More from Office
9.8
CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
9.8
CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
8.8
CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
8.8
CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
8.8
CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability