CVE-2004-0842: Avaya Definity One Media Server

High severity, CVSS 7.5. EPSS: 56.6% chance of exploitation in the next 30 days.

Internet Explorer 6.0 SP1 and earlier, and possibly other versions, allows remote attackers to cause a denial of service (application crash from "memory corruption") via certain malformed Cascading Style Sheet (CSS) elements that trigger heap-based buffer overflows, as demonstrated using the "<STYLE>@;/*" string, possibly due to a missing comment terminator that may cause an invalid length to trigger a large memory copy operation, aka the "CSS Heap Memory Corruption Vulnerability."

Affected products

• Avaya Definity One Media Server: any version
• Avaya IP600 Media Servers: any version
• Avaya Modular Messaging Message Storage Server: version 1.1 only; version 2.0 only
• Avaya s3400: any version
• Avaya s8100: any version
• Microsoft Ie: version 6.0 only
• Microsoft Internet Explorer: version 5.0.1 only; version 5.5 only; version 6.0 only

Published 2004-12-23. Last modified 2026-06-16.