Vulnerability Details : CVE-2006-0006
Potential exploit
Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap (.BMP) file that specifies a size of 0 but contains additional data.
Vulnerability category: OverflowExecute code
Products affected by CVE-2006-0006
- cpe:2.3:o:microsoft:windows_2000:*:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2000:*:sp4:*:fr:*:*:*:*
- cpe:2.3:o:microsoft:windows_98:*:gold:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_98se:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_player:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_player:9:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:windows_media_player:10:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_me:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_2003_server:r2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-0006
73.90%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-0006
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2006-0006
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2006-0006
-
http://securityreason.com/securityalert/423
-
http://www.us-cert.gov/cas/techalerts/TA06-045A.html
Third Party Advisory;US Government Resource
-
http://securitytracker.com/id?1015627
Patch
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1661
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1598
-
http://secunia.com/advisories/18835
Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/16633
Exploit;Patch
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1256
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-005
-
http://www.eeye.com/html/research/advisories/AD20060214.html
Patch;Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1578
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/24488
-
http://www.securityfocus.com/archive/1/424983/100/0/threaded
-
http://www.securityfocus.com/archive/1/425158/100/0/threaded
-
http://www.kb.cert.org/vuls/id/291396
Third Party Advisory;US Government Resource
-
http://www.vupen.com/english/advisories/2006/0574
Vendor Advisory
Jump to