CVE-2005-0063

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The document processing application used by the Windows Shell in Microsoft Windows 2000, Windows XP, and Windows Server 2003 allows remote attackers to execute arbitrary code by modifying the CLSID stored in a file so that it is processed by HTML Application Host (MSHTA), as demonstrated using a Microsoft Word document.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
May 2, 2005
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2005

CVE-2005-00647.5Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary cCVE-2005-006510.0The original design of TCP does not check that the TCP sequence number in an ICMP error message is within the range of sequence numbers for CVE-2005-00665.0The original design of TCP does not check that the TCP Acknowledgement number in an ICMP error message generated by an intermediate router iCVE-2005-00675.0The original design of TCP does not require that port numbers be assigned randomly (aka "Port randomization"), which makes it easier for attCVE-2005-00685.0The original design of ICMP does not require authentication for host-generated ICMP error messages, which makes it easier for attackers to fCVE-2005-00694.6The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on tempoCVE-2005-00707.2Synaesthesia 2.1 and earlier, and possibly other versions, when installed setuid root, does not drop privileges before processing configuratCVE-2005-00715.0vdr before 1.2.6 does not securely create files, which allows attackers to overwrite arbitrary files.CVE-2005-00722.1zhcon before 0.2 does not drop privileges before reading a user configuration file, which allows local users to read arbitrary files.CVE-2005-00734.6Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.CVE-2005-00747.2Buffer overflow in pcdsvgaview in xpcd 2.08 allows local users to execute arbitrary code.CVE-2005-00755.0prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail co
CVE-2005-0063: High severity, CVSS 7.5 | Vulnix