{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Internet Explorer 6 Service Pack 1 sous Microsoft Windows NT Server 4.0 Service Pack 6a ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 6 Service Pack 1 sous Microsoft Windows XP Service Pack 1 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 6 Service Pack 1 sous Microsoft Windows 98, Windows 98 SE \u0026 Windows Me ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 6 sous Microsoft Windows XP Service Pack 1 (64-bit Edition).",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 6 Service Pack 1 sous Microsoft Windows 2000 Service Pack 3 \u0026 Service Pack 4 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer 6 Service Pack 1 sous Microsoft Windows NT Server 4.0 Terminal Service Edition Service Pack 6 ;",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLe logiciel de navigation Internet Explorer 6 de Microsoft pr\u00e9sente une\nvuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire (Buffer Overflow) due \u00e0 un\nmauvais traitement des attributs SRC et NAME des balises \\\u003cFRAME\\\u003e et\n\\\u003cIFRAME\\\u003e qui permettent aux d\u00e9veloppeurs d\u0027ins\u00e9rer des cadres dans une\npage HTML. Cette vuln\u00e9rabilit\u00e9 permet \u00e0 une personne mal intentionn\u00e9e\nd\u0027ex\u00e9cuter du code arbitraire, avec les privil\u00e8ges de la victime, \u00e0\nl\u0027aide d\u0027une page HTML ou d\u0027un courrier \u00e9lectronique malicieusement\nconstitu\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. Documentation).\n",
  "cves": [],
  "initial_release_date": "2004-12-02T00:00:00",
  "last_revision_date": "2004-12-02T00:00:00",
  "links": [
    {
      "title": "Bulletin d\u0027alerte CERTA-2004-ALE-012 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2004-ALE-012/index.html"
    }
  ],
  "reference": "CERTA-2004-AVI-383",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2004-12-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 d\u00e9couverte dans Internet Explorer 6 permet \u00e0 un\nutilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter du code arbitraire sur le syst\u00e8me\nvuln\u00e9rable.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Internet Explorer 6",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin d\u0027alerte de s\u00e9curit\u00e9 CERTA-2004-ALE-012",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS04-040",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS04-040.mspx"
    }
  ]
}