Microsoft Internet Explorer allows remote attackers to cause a denial of service (memory…
Priority MEDIUM 52Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Microsoft Internet Explorer allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code by instantiating certain Windows 2000 ActiveX COM Objects including (1) ciodm.dll, (2) myinfo.dll, (3) msdxm.ocx, and (4) creator.dll.
Why it matters now
EPSS 0.20706 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:* | 6.0 sp1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:2000_server:*:*:*:*:*:*:* | 2000_server | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp1:*:*:*:*:*:* | 2000_server sp1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp2:*:*:*:*:*:* | 2000_server sp2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp3:*:*:*:*:*:* | 2000_server sp3 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp4:*:*:*:*:*:* | 2000_server sp4 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:advanced_server:*:*:*:*:*:*:* | advanced_server | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp1:*:*:*:*:*:* | advanced_server sp1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp2:*:*:*:*:*:* | advanced_server sp2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp3:*:*:*:*:*:* | advanced_server sp3 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:* Versions 6.0 sp1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:2000_server:*:*:*:*:*:*:* Versions 2000_server Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp1:*:*:*:*:*:* Versions 2000_server sp1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp2:*:*:*:*:*:* Versions 2000_server sp2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp3:*:*:*:*:*:* Versions 2000_server sp3 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:2000_server:sp4:*:*:*:*:*:* Versions 2000_server sp4 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:advanced_server:*:*:*:*:*:*:* Versions advanced_server Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp1:*:*:*:*:*:* Versions advanced_server sp1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp2:*:*:*:*:*:* Versions advanced_server sp2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp3:*:*:*:*:*:* Versions advanced_server sp3 Vulnerable ·Microsoft
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp4:*:*:*:*:*:* | advanced_server sp4 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:*:*:*:*:*:*:* | datacenter_server | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp1:*:*:*:*:*:* | datacenter_server sp1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp2:*:*:*:*:*:* | datacenter_server sp2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp3:*:*:*:*:*:* | datacenter_server sp3 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp4:*:*:*:*:*:* | datacenter_server sp4 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:professional:*:*:*:*:*:*:* | professional | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:professional:sp1:*:*:*:*:*:* | professional sp1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:professional:sp2:*:*:*:*:*:* | professional sp2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:professional:sp3:*:*:*:*:*:* | professional sp3 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_2003_server:professional:sp4:*:*:*:*:*:* | professional sp4 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_2003_server:advanced_server:sp4:*:*:*:*:*:* Versions advanced_server sp4 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:*:*:*:*:*:*:* Versions datacenter_server Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp1:*:*:*:*:*:* Versions datacenter_server sp1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp2:*:*:*:*:*:* Versions datacenter_server sp2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp3:*:*:*:*:*:* Versions datacenter_server sp3 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:datacenter_server:sp4:*:*:*:*:*:* Versions datacenter_server sp4 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:professional:*:*:*:*:*:*:* Versions professional Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:professional:sp1:*:*:*:*:*:* Versions professional sp1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:professional:sp2:*:*:*:*:*:* Versions professional sp2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:professional:sp3:*:*:*:*:*:* Versions professional sp3 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_2003_server:professional:sp4:*:*:*:*:*:* Versions professional sp4 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-4495
- 2026-10-03 Alias added: GHSA-jqfg-7337-c7c8
References
More Microsoft Ie vulnerabilities
- TI-2004-00947 Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute… CVSS 2.0HIGH 10.0
- TI-2004-00183 Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet… CVSS 2.0HIGH 10.0
- TI-2007-00210 The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow… CVSS 2.0HIGH 10.0
- TI-2006-01313 Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of… CVSS 2.0HIGH 9.3
- TI-2006-01146 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 10.0
- TI-2006-03617 Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote… CVSS 3.1HIGH 8.8
Sources
- CVE-2006-4495 · CVE Program
- CVE-2006-4495 · NVD
- FIRST EPSS
- GHSA-jqfg-7337-c7c8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences