Microsoft Patch Tuesday, September 2006: the CVEs

Microsoft Patch Tuesday September 2006: the CVEs Microsoft published on 12 September 2006, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Aug 2006, Jul 2006, Jun 2006, May 2006, Apr 2006, Mar 2006, Feb 2006, Jan 2006, Dec 2005, Nov 2005, Oct 2005, Sep 2005. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. –CVE-2006-3873EPSS 29%2006-09-12

   Heap-based buffer overflow in URLMON.DLL in Microsoft Internet Explorer 6 SP1 on Windows 2000 and XP SP1, with versions the MS06-042 patch before 20060912, allows remote attackers to cause a denial of service (crash) or execute arbitrary c…

2. –CVE-2006-3442EPSS 27%2006-09-12

   Unspecified vulnerability in Pragmatic General Multicast (PGM) in Microsoft Windows XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted multicast message.

3. –CVE-2006-0032ExploitEPSS 25%2006-09-12

   Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 enc…

4. –CVE-2006-0001EPSS 42%2006-09-12

   Stack-based buffer overflow in Microsoft Publisher 2000 through 2003 allows user-assisted remote attackers to execute arbitrary code via a crafted PUB file, which causes an overflow when parsing fonts.