CVE-2006-4692

Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."

• CWE-88

• http://secunia.com/advisories/20717Broken Link, Vendor Advisory
• http://secunia.com/secunia_research/2006-54/advisory/Broken Link, Vendor Advisory
• http://securitytracker.com/id?1017037Broken Link, Third Party Advisory, VDB Entry
• http://www.kb.cert.org/vuls/id/703936Third Party Advisory, US Government Resource
• http://www.osvdb.org/29424Broken Link
• http://www.securityfocus.com/archive/1/448273/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/448696/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/449179/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/20318Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/3984Broken Link, Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-065Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A496Broken Link
• http://secunia.com/advisories/20717Broken Link, Vendor Advisory
• http://secunia.com/secunia_research/2006-54/advisory/Broken Link, Vendor Advisory
• http://securitytracker.com/id?1017037Broken Link, Third Party Advisory, VDB Entry
• http://www.kb.cert.org/vuls/id/703936Third Party Advisory, US Government Resource
• http://www.osvdb.org/29424Broken Link
• http://www.securityfocus.com/archive/1/448273/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/448696/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/449179/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/20318Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/3984Broken Link, Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-065Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A496Broken Link

Published

Oct 10, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4686Buffer overflow in the Extensible Stylesheet Language Transf…
• CVE-2006-4687Microsoft Internet Explorer 5.01 through 6 allows remote att…
• CVE-2006-4688Buffer overflow in Client Service for NetWare (CSNW) in Micr…
• CVE-2006-4689Unspecified vulnerability in the driver for the Client Servi…
• CVE-2006-4690Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2006-4691Stack-based buffer overflow in the NetpManageIPCConnect func…
• CVE-2006-4693Unspecified vulnerability in Microsoft Word 2004 for Mac and…
• CVE-2006-4694Unspecified vulnerability in PowerPoint in Microsoft Office …
• CVE-2006-4695Unspecified vulnerability in certain COM objects in Microsof…
• CVE-2006-4696Unspecified vulnerability in the Server service in Microsoft…
• CVE-2006-4697Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM …
• CVE-2006-4698Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…