Microsoft Patch Tuesday, April 2006: the CVEs

Microsoft Patch Tuesday April 2006: the CVEs Microsoft published on 11 April 2006, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Mar 2006, Feb 2006, Jan 2006, Dec 2005, Nov 2005, Oct 2005, Sep 2005, Aug 2005, Jul 2005, Jun 2005, May 2005, Apr 2005. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. –CVE-2006-1719EPSS 14%2006-04-11

   Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) via any scrollbar Cascading Style Sheets (CSS) property.

2. –CVE-2006-1192ExploitEPSS 32%2006-04-11

   Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via unknown methods that allow "window content to persist" after the user has naviga…

3. –CVE-2006-1191ExploitEPSS 32%2006-04-11

   Microsoft Internet Explorer 5.01 through 6 does not always correctly identify the domain that is associated with a browser window, which allows remote attackers to obtain sensitive cross-domain information and spoof sites by running script…

4. –CVE-2006-1190ExploitEPSS 62%2006-04-11

   Microsoft Internet Explorer 5.01 through 6 does not always return the correct IOleClientSite information when dynamically creating an embedded object, which could cause Internet Explorer to run the object in the wrong security context or z…

5. –CVE-2006-1189ExploitEPSS 62%2006-04-11

   Buffer overflow in URLMON.DLL in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via a crafted URL with an International Domain Name (IDN) using double-byte character sets (DBCS), aka the "Doubl…

6. –CVE-2006-1188ExploitEPSS 58%2006-04-11

   Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memory corruption.

7. –CVE-2006-1186ExploitEPSS 58%2006-04-11

   Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM objects as ActiveX controls, which leads to memory corruption.

8. –CVE-2006-1185ExploitEPSS 70%2006-04-11

   Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes memory corruption.

9. –CVE-2006-0015ExploitEPSS 25%2006-04-11

   Cross-site scripting (XSS) vulnerability in _vti_bin/_vti_adm/fpadmdll.dll in Microsoft FrontPage Server Extensions 2002 and SharePoint Team Services allows remote attackers to inject arbitrary web script or HTML, then leverage the attack …