CVEvulnerability
CVE-2004-0201
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2004-08-06
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
Heap-based buffer overflow in the HtmlHelp program (hh.exe) in HTML Help for Microsoft Windows 98, Me, NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary commands via a .CHM file with a large length field, a different vulnerability than CVE-2003-1041.
Affected configurations
• avaya ip600 media servers
• avaya definity one media server
• avaya s8100
• avaya modular messaging message storage server s3400
• microsoft windows 2000
• microsoft windows 2003 server enterprise
• microsoft windows 2003 server enterprise 64-bit
• microsoft windows 2003 server r2
• microsoft windows 2003 server standard
• microsoft windows 2003 server web
• microsoft windows 98
• microsoft windows 98se
• microsoft windows me
• microsoft windows nt 4.0
• microsoft windows xp
Related
Referenced by CWE · observed example (1)
- CWE-130 Improper Handling of Length Parameter Inconsistency weakness
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023919.html lists.grok.org.uk
- http://www.kb.cert.org/vuls/id/920060 Patch, Third Party Advisory, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-196A.html Patch, Third Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-023 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16586 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1503 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1530 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2155 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3179 oval.cisecurity.org
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-July/023919.html lists.grok.org.uk
- http://www.kb.cert.org/vuls/id/920060 Patch, Third Party Advisory, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA04-196A.html Patch, Third Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-023 docs.microsoft.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16586 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1503 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1530 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2155 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3179 oval.cisecurity.org