CVE-2003-1048

high-risk

Published 2004-07-27

Double free vulnerability in mshtml.dll for certain versions of Internet Explorer 6.x allows remote attackers to cause a denial of service (application crash) via a malformed GIF image.

Do I need to act?

33.2% chance of exploitation in next 30 days

EPSS score — higher than 67% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (18)

Internet Explorer

Outlook

Windows 98Se

Windows Nt

Windows Xp

Internet Explorer

Outlook

Windows 98

Windows Me

Windows Nt

Windows Server 2003

Windows Xp

Affected Vendors

Microsoft

References (32)

Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009445.html

Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009473.html

Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009506.html

Broken Link http://www.ciac.org/ciac/bulletins/o-191.shtml

Third Party Advisory http://www.kb.cert.org/vuls/id/685364

Broken Link http://www.securityfocus.com/bid/8530

Broken Link http://www.us-cert.gov/cas/techalerts/TA04-212A.html

Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-02...

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/16804

Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...

Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009445.html

Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009473.html

Broken Link http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009506.html

Broken Link http://www.ciac.org/ciac/bulletins/o-191.shtml

and 12 more references

/ 100

high-risk

Severity 24/34 · High

Exploitability 16/34 · Moderate

Exposure 19/34 · Moderate