Microsoft Internet Explorer UTF-8 Decoding Heap Overflow VulnerabilityZDI-06-017: June 13th, 2006
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 4440. For further product information on the TippingPoint IPS:
The specific vulnerability is due to a miscalculation of memory sizes when translating UTF-8 characters to Unicode. A size mismatch between a heap allocation and memory copy results in an exploitable heap corruption.
Vendor ResponseMicrosoft has issued an update to correct this vulnerability. More details can be found at:
2006-01-20 - Vulnerability reported to vendor
2006-06-13 - Coordinated public release of advisory
CreditThis vulnerability was discovered by: