Vulnerability-Lookup

CERTA-2006-AVI-441

Vulnerability from certfr_avis - Published: 2006-10-11 - Updated: 2006-10-11

Deux vulnérabilités découvertes dans Microsoft XML Core Services permettent à un utilisateur mal intentionné de porter atteinte à la confidentialité des données et/ou d'exécuter du code arbitraire à distance.

Description

Microsoft XML Core Services permet aux clients de concevoir des applications XML au standard XML 1.0.

Une vulnérabilité dans Microsoft XML Core Services permet à un individu mal intentionné de porter atteinte à la confidentialité des données notammment en ayant accès aux informations de session (cookies).

eXtensible Stylesheet Language Transformations (XSLT) permet de manipuler des données au format XML.

Une vulnérabilité dans XSLT peut être exploitée par une personne malveillante afin d'exécuter du code arbitraire à distance.

Ces vulnérabilités peuvent être exploitées au moyen d'un site web spécialement construit.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Microsoft XML Parser 2.6 (toutes versions) et Microsoft XML Core Services 3.0 (toutes versions) sur :
- Microsoft Windows 2000 Service Pack 4 ;
- Microsoft Windows XP Service Pack 1 ;
- Microsoft Windows XP Service Pack 2 ;
- Microsoft Windows XP Professonal x64 Edition ;
- Microsoft Windows Server 2003 ;
- Microsoft Windows Server 2003 Service Pack 1 ;
- Microsoft Windows Server 2003 et Windows Server 2003 Service Pack 1 pour système Itanium.
Microsoft XML Core Services 4.0 sur :
- Microsoft Windows 2000 Service Pack 4 ;
- Microsoft Windows XP Service Pack 1 ;
- Microsoft Windows XP Service Pack 2 ;
- Microsoft Windows Server 2003 ;
- Microsoft Windows Server 2003 Service Pack 1.
Microsoft XML Core Services 5.0 Service Pack 1 sur :
- Microsoft Office 2003 Service Pack 1 et Service Pack 2.
Microsoft XML Core Services 6.0 sur :
- Microsoft Windows 2000 Service Pack 4 ;
- Microsoft Windows XP Service Pack 1 ;
- Microsoft Windows XP Service Pack 2 ;
- Microsoft Windows Server 2003 ;
- Microsoft Windows Server 2003 Service Pack 1.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS06-061 du 10 octobre 2006

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cOL\u003e    \u003cLI\u003eMicrosoft XML Parser 2.6 (toutes versions) et Microsoft XML    Core Services 3.0 (toutes versions) sur :      \u003cUL\u003e        \u003cLI\u003eMicrosoft Windows 2000 Service Pack 4 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Service Pack 1 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Service Pack 2 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Professonal x64 Edition ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 Service Pack 1 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 et Windows Server 2003        Service Pack 1 pour syst\u00e8me Itanium.\u003c/LI\u003e      \u003c/UL\u003e    \u003c/LI\u003e    \u003cLI\u003eMicrosoft XML Core Services 4.0 sur :      \u003cUL\u003e        \u003cLI\u003eMicrosoft Windows 2000 Service Pack 4 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Service Pack 1 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Service Pack 2 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 Service Pack 1.\u003c/LI\u003e      \u003c/UL\u003e    \u003c/LI\u003e    \u003cLI\u003eMicrosoft XML Core Services 5.0 Service Pack 1 sur :      \u003cUL\u003e        \u003cLI\u003eMicrosoft Office 2003 Service Pack 1 et Service Pack        2.\u003c/LI\u003e      \u003c/UL\u003e    \u003c/LI\u003e    \u003cLI\u003eMicrosoft XML Core Services 6.0 sur :      \u003cUL\u003e        \u003cLI\u003eMicrosoft Windows 2000 Service Pack 4 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Service Pack 1 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows XP Service Pack 2 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 ;\u003c/LI\u003e        \u003cLI\u003eMicrosoft Windows Server 2003 Service Pack 1.\u003c/LI\u003e      \u003c/UL\u003e    \u003c/LI\u003e  \u003c/OL\u003e",
  "content": "## Description\n\nMicrosoft XML Core Services permet aux clients de concevoir des\napplications XML au standard XML 1.0.\n\n-   Une vuln\u00e9rabilit\u00e9 dans Microsoft XML Core Services permet \u00e0 un\n    individu mal intentionn\u00e9 de porter atteinte \u00e0 la confidentialit\u00e9 des\n    donn\u00e9es notammment en ayant acc\u00e8s aux informations de session\n    (cookies).\n\neXtensible Stylesheet Language Transformations (XSLT) permet de\nmanipuler des donn\u00e9es au format XML.\n\n-   Une vuln\u00e9rabilit\u00e9 dans XSLT peut \u00eatre exploit\u00e9e par une personne\n    malveillante afin d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n\nCes vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es au moyen d\u0027un site web\nsp\u00e9cialement construit.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4686"
    },
    {
      "name": "CVE-2006-4685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4685"
    }
  ],
  "initial_release_date": "2006-10-11T00:00:00",
  "last_revision_date": "2006-10-11T00:00:00",
  "links": [],
  "reference": "CERTA-2006-AVI-441",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans Microsoft XML Core Services\npermettent \u00e0 un utilisateur mal intentionn\u00e9 de porter atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et/ou d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Microsoft XML Core Services",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-061 du 10 octobre 2006",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-061.mspx"
    }
  ]
}

CVE-2006-4685 (GCVE-0-2006-4685)

Vulnerability from cvelistv5 – Published: 2006-10-10 22:00 – Updated: 2024-08-07 19:23

Summary

The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains.

Severity ?

No CVSS data available.

CWE

Assigner

microsoft

References

URL

Tags

	http://secunia.com/advisories/22333	third-party-advisoryx_refsource_SECUNIA
	http://www.kb.cert.org/vuls/id/547212	third-party-advisoryx_refsource_CERT-VN
	https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS
	https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
	http://www.securityfocus.com/bid/20339	vdb-entryx_refsource_BID
	http://www.securityfocus.com/archive/1/449179/100…	vendor-advisoryx_refsource_HP
	http://www.securityfocus.com/archive/1/449179/100…	vendor-advisoryx_refsource_HP
	http://securitytracker.com/id?1017033	vdb-entryx_refsource_SECTRACK
	http://www.osvdb.org/29425	vdb-entryx_refsource_OSVDB
	http://www.vupen.com/english/advisories/2006/3980	vdb-entryx_refsource_VUPEN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:23:41.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "22333",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22333"
          },
          {
            "name": "VU#547212",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/547212"
          },
          {
            "name": "MS06-061",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061"
          },
          {
            "name": "oval:org.mitre.oval:def:221",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A221"
          },
          {
            "name": "20339",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/20339"
          },
          {
            "name": "SSRT061264",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
          },
          {
            "name": "HPSBST02161",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
          },
          {
            "name": "1017033",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017033"
          },
          {
            "name": "29425",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/29425"
          },
          {
            "name": "ADV-2006-3980",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3980"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-10-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "22333",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22333"
        },
        {
          "name": "VU#547212",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/547212"
        },
        {
          "name": "MS06-061",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061"
        },
        {
          "name": "oval:org.mitre.oval:def:221",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A221"
        },
        {
          "name": "20339",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/20339"
        },
        {
          "name": "SSRT061264",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
        },
        {
          "name": "HPSBST02161",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
        },
        {
          "name": "1017033",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017033"
        },
        {
          "name": "29425",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/29425"
        },
        {
          "name": "ADV-2006-3980",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3980"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2006-4685",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "22333",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22333"
            },
            {
              "name": "VU#547212",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/547212"
            },
            {
              "name": "MS06-061",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061"
            },
            {
              "name": "oval:org.mitre.oval:def:221",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A221"
            },
            {
              "name": "20339",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/20339"
            },
            {
              "name": "SSRT061264",
              "refsource": "HP",
              "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
            },
            {
              "name": "HPSBST02161",
              "refsource": "HP",
              "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
            },
            {
              "name": "1017033",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017033"
            },
            {
              "name": "29425",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/29425"
            },
            {
              "name": "ADV-2006-3980",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3980"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2006-4685",
    "datePublished": "2006-10-10T22:00:00",
    "dateReserved": "2006-09-11T00:00:00",
    "dateUpdated": "2024-08-07T19:23:41.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2006-4686 (GCVE-0-2006-4686)

Vulnerability from cvelistv5 – Published: 2006-10-10 22:00 – Updated: 2024-08-07 19:23

Summary

Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page.

Severity ?

No CVSS data available.

CWE

Assigner

microsoft

References

URL

Tags

	http://secunia.com/advisories/22333	third-party-advisoryx_refsource_SECUNIA
	https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS
	http://www.securityfocus.com/archive/1/449179/100…	vendor-advisoryx_refsource_HP
	http://www.kb.cert.org/vuls/id/562788	third-party-advisoryx_refsource_CERT-VN
	https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
	http://www.osvdb.org/29426	vdb-entryx_refsource_OSVDB
	http://www.securityfocus.com/archive/1/449179/100…	vendor-advisoryx_refsource_HP
	http://securitytracker.com/id?1017033	vdb-entryx_refsource_SECTRACK
	http://www.vupen.com/english/advisories/2006/3980	vdb-entryx_refsource_VUPEN
	http://www.securityfocus.com/bid/20338	vdb-entryx_refsource_BID

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:23:40.418Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "22333",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22333"
          },
          {
            "name": "MS06-061",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061"
          },
          {
            "name": "SSRT061264",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
          },
          {
            "name": "VU#562788",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/562788"
          },
          {
            "name": "oval:org.mitre.oval:def:285",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A285"
          },
          {
            "name": "29426",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/29426"
          },
          {
            "name": "HPSBST02161",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
          },
          {
            "name": "1017033",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017033"
          },
          {
            "name": "ADV-2006-3980",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3980"
          },
          {
            "name": "20338",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/20338"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-10-10T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "22333",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22333"
        },
        {
          "name": "MS06-061",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061"
        },
        {
          "name": "SSRT061264",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
        },
        {
          "name": "VU#562788",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/562788"
        },
        {
          "name": "oval:org.mitre.oval:def:285",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A285"
        },
        {
          "name": "29426",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/29426"
        },
        {
          "name": "HPSBST02161",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
        },
        {
          "name": "1017033",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017033"
        },
        {
          "name": "ADV-2006-3980",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3980"
        },
        {
          "name": "20338",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/20338"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2006-4686",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "22333",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22333"
            },
            {
              "name": "MS06-061",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061"
            },
            {
              "name": "SSRT061264",
              "refsource": "HP",
              "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
            },
            {
              "name": "VU#562788",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/562788"
            },
            {
              "name": "oval:org.mitre.oval:def:285",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A285"
            },
            {
              "name": "29426",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/29426"
            },
            {
              "name": "HPSBST02161",
              "refsource": "HP",
              "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
            },
            {
              "name": "1017033",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017033"
            },
            {
              "name": "ADV-2006-3980",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3980"
            },
            {
              "name": "20338",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/20338"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2006-4686",
    "datePublished": "2006-10-10T22:00:00",
    "dateReserved": "2006-09-11T00:00:00",
    "dateUpdated": "2024-08-07T19:23:40.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTA-2006-AVI-441

Description

Solution

CVE-2006-4685 (GCVE-0-2006-4685)

CVE-2006-4686 (GCVE-0-2006-4686)

Tags

Sightings

Nomenclature