Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Internet Explorer 5‑6 can crash or run code

CVE-2005-1990 · published 21 years ago
Summary

Internet Explorer versions 5.0, 5.5, and 6.0 may be tricked by a malicious web page into loading certain system components, which can cause the browser to stop working or allow code to run on the user's computer. This happens because the page can embed special identifiers that make the browser load vulnerable code libraries. Updating to a newer browser version or applying any available patches eliminates the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft ie 6
cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*
microsoft internet_explorer 5.01
5.5
cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
Original advisory text
Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference c...
Internet Explorer 5.0, 5.5, and 6.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a web page with embedded CLSIDs that reference certain COM objects that are not ActiveX controls, including (1) devenum.dll, (2) diactfrm.dll, (3) wmm2filt.dll, (4) fsusd.dll, (5) dmdskmgr.dll, (6) browsewm.dll, (7) browseui.dll, (8) shell32.dll, (9) mshtml.dll, (10) inetcfg.dll, (11) infosoft.dll, (12) query.dll, (13) syncui.dll, (14) clbcatex.dll, (15) clbcatq.dll, (16) comsvcs.dll, and (17) msconf.dll, which causes memory corruption, aka "COM Object Instantiation Memory Corruption Vulnerability," a different vulnerability than CVE-2005-2087.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.1 Medium
Exploitation
49% chance of attack within 30 days
Timeline
Published10 Aug 2005
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2005-1990 · NVD
Track software like this
Free during beta