9.3
CVE-2006-5559
- EPSS 71.16%
- Published 27.10.2006 16:07:00
- Last modified 09.04.2025 00:30:58
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.
Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Data Access Components Version2.5 Updatesp3
Microsoft ≫ Data Access Components Version2.8 Updatesp1
Microsoft ≫ Data Access Components Version2.8
Microsoft ≫ Data Access Components Version2.7 Updatesp1
Microsoft ≫ Data Access Components Version2.8
Microsoft ≫ Data Access Components Version2.8 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 71.16% | 0.987 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.