CVE-2006-0020

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

An unspecified Microsoft WMF parsing application, as used in Internet Explorer 5.01 SP4 on Windows 2000 SP4, and 5.5 SP2 on Windows Millennium, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute code via a crafted WMF file with a manipulated WMF header size, possibly involving an integer overflow, a different vulnerability than CVE-2005-4560, and aka "WMF Image Parsing Memory Corruption Vulnerability."

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://linuxbox.org/pipermail/funsec/2006-January/002828.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18729Patch, Vendor Advisory
http://secunia.com/advisories/18912Vendor Advisory
http://www.kb.cert.org/vuls/id/312956Patch, Third Party Advisory, US Government Resource
http://www.microsoft.com/technet/security/advisory/913333.mspxVendor Advisory
http://www.osvdb.org/22976
http://www.securityfocus.com/bid/16516Patch
http://www.us-cert.gov/cas/techalerts/TA06-045A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2006/0469
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-004
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1638
http://linuxbox.org/pipermail/funsec/2006-January/002828.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18729Patch, Vendor Advisory
http://secunia.com/advisories/18912Vendor Advisory
http://www.kb.cert.org/vuls/id/312956Patch, Third Party Advisory, US Government Resource
http://www.microsoft.com/technet/security/advisory/913333.mspxVendor Advisory
http://www.osvdb.org/22976
http://www.securityfocus.com/bid/16516Patch
http://www.us-cert.gov/cas/techalerts/TA06-045A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2006/0469
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-004
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1638

Timeline

Published: Jan 10, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-00217.8Microsoft Windows XP SP1 and SP2, and Server 2003 up to SP1, allows remote attackers to cause a denial of service (hang) via an IGMP packet CVE-2006-00227.6Unspecified vulnerability in Microsoft PowerPoint in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP1 and SP2, Office 2004 for Mac,CVE-2006-00234.3Microsoft Windows XP SP1 and SP2 before August 2004, and possibly other operating systems and versions, uses insecure default ACLs that allo CVE-2006-00245.1Multiple unspecified vulnerabilities in Adobe Flash Player 8.0.22.0 and earlier allow remote attackers to execute arbitrary code via a craft CVE-2006-00259.3Stack-based buffer overflow in Microsoft Windows Media Player 9 and 10 allows remote attackers to execute arbitrary code via a PNG image wit CVE-2006-00266.5Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arb CVE-2006-00277.5Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal CVE-2006-00285.1Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted att CVE-2006-00295.1Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted att CVE-2006-00305.1Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted att CVE-2006-00315.1Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted a CVE-2006-00324.3Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is