CVE-2006-3899

MEDIUM 5.0CVE-2006-3899 · Published 27/07/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
internet explorer microsoft	`= 6.0`	No fix yet

Description

Microsoft Internet Explorer 6.0 on Windows XP SP2 allows remote attackers to cause a denial of service (application crash) by calling the stringToBinary function of the CEnroll.CEnroll.2 ActiveX object with a long second argument, which triggers an invalid memory access inside the SysAllocStringLen function.

References

browserfun.blogspot.com/2006/07/mobb-21-cenroll-stringtobinary.html · Broken Link
osvdb.org/27230 · Broken Link
securityfocus.com/bid/19102 · Exploit
vupen.com/english/advisories/2006/2916 · Not Applicable
exchange.xforce.ibmcloud.com/vulnerabilities/27884 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free