CVE-2006-7206

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating a ADODB.Recordset object and making a series of calls to the NextRecordset method with a long string argument, which causes an "invalid memory access" in the SysFreeString function, a different issue than CVE-2006-3510 and CVE-2006-3899.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2007
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2006

CVE-2006-720710.0Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors.CVE-2006-72086.8PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 anCVE-2006-72094.3Multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or CVE-2006-72105.0Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a PNG image with crafCVE-2006-72114.9fb_lock_mgr in Firebird 1.5 uses weak permissions (0666) for the semaphore array, which allows local users to cause a denial of service (bloCVE-2006-72126.8Multiple buffer overflows in Firebird 1.5, one of which affects WNET, have unknown impact and attack vectors. NOTE: this issue might overlaCVE-2006-72135.5Firebird 1.5 allows remote authenticated users without SYSDBA and owner permissions to overwrite a database by creating a database.CVE-2006-72147.8Multiple unspecified vulnerabilities in Firebird 1.5 allow remote attackers to (1) cause a denial of service (application crash) by sending CVE-2006-72152.1The Intel Core 2 Extreme processor X6800 and Core 2 Duo desktop processor E6000 and E4000 incorrectly set the memory page Access (A) bit forCVE-2006-72164.0Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does CVE-2006-72174.0Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authCVE-2006-72184.0eZ publish before 3.8.1 does not properly enforce permissions for "content edit Language" when there are four or more languages, which allow