CVE-2005-0056

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Internet Explorer 5.01, 5.5, and 6 does not properly validate certain URLs in Channel Definition Format (CDF) files, which allows remote attackers to obtain sensitive information or execute arbitrary code, aka the "Channel Definition Format (CDF) Cross Domain Vulnerability."

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: May 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-00577.5The Hyperlink Object Library for Windows 98, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a crafted link CVE-2005-00587.5Buffer overflow in the Telephony Application Programming Interface (TAPI) for Microsoft Windows 98, Windows 98 SE, Windows ME, Windows 2000,CVE-2005-005910.0Buffer overflow in the Message Queuing component of Microsoft Windows 2000 and Windows XP SP1 allows remote attackers to execute arbitrary c CVE-2005-00607.2Buffer overflow in the font processing component of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local use CVE-2005-00617.2The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2, and Windows Server 2003 allows local users to gain privileges via certain acce CVE-2005-00637.5The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote a CVE-2005-00647.5Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary c CVE-2005-006510.0The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for CVE-2005-00665.0The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router i CVE-2005-00675.0The original design of TCP does not require that port numbers be assigned randomly (aka "Port randomization"), which makes it easier for att CVE-2005-00685.0The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to f CVE-2005-00694.6The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on tempo