CVE-2006-0010

Description

Heap-based buffer overflow in T2EMBED.DLL in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 up to SP1, Windows 98, and Windows ME allows remote attackers to execute arbitrary code via an e-mail message or web page with a crafted Embedded Open Type (EOT) web font that triggers the overflow during decompression.

Category

9.3
CVSS
Severity: Critical
CVSS 2.0 •
EPSS 67.40% Top 5%
Vendor Advisory microsoft.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://seclists.org/fulldisclosure/2006/Jan/363 mailing list
http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375525
http://www.kb.cert.org/vuls/id/915930 third party advisory us government resource
http://www.eeye.com/html/Research/Advisories/EEYEB20050801.html third party advisory
http://support.avaya.com/elmodocs2/security/ASA-2006-004.htm
http://www.osvdb.org/18829 vdb entry
http://www.vupen.com/english/advisories/2006/0118 vdb entry
http://secunia.com/advisories/18391 third party advisory vendor advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-002 vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/23922 vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A698 signature vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1185 signature vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A714 signature vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1462 signature vdb entry
http://securitytracker.com/id?1015459 vdb entry
http://secunia.com/advisories/18311 third party advisory vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1126 signature vdb entry
http://secunia.com/advisories/18365 patch vendor advisory third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1491 signature vdb entry
http://www.securityfocus.com/archive/1/421885/100/0/threaded mailing list
http://www.securityfocus.com/bid/16194 patch vdb entry
http://www.us-cert.gov/cas/techalerts/TA06-010A.html third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2006-0010?
CVE-2006-0010 has been scored as a critical severity vulnerability.
How to fix CVE-2006-0010?
To fix CVE-2006-0010, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-0010 being actively exploited in the wild?
It is possible that CVE-2006-0010 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~67% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.