CVE-2006-5559

The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects (ADODB.Connection.2.7 and ADODB.Connection.2.8) in the Microsoft Data Access Components (MDAC) 2.5 SP3, 2.7 SP1, 2.8, and 2.8 SP1 does not properly track freed memory when the second argument is a BSTR, which allows remote attackers to cause a denial of service (Internet Explorer crash) and possibly execute arbitrary code via certain strings in the second and third arguments.

• CWE-20

• http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx
• http://research.eeye.com/html/alerts/zeroday/20061027.htmlPatch
• http://secunia.com/advisories/22452Vendor Advisory
• http://securitytracker.com/id?1017127Exploit, Patch, Vendor Advisory
• http://www.kb.cert.org/vuls/id/589272Patch, US Government Resource
• http://www.osvdb.org/31882
• http://www.securityfocus.com/bid/20704Exploit, Patch
• http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2007/0578Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29837
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A214
• http://blogs.technet.com/msrc/archive/2006/10/27/adodb-connection-poc-published.aspx
• http://research.eeye.com/html/alerts/zeroday/20061027.htmlPatch
• http://secunia.com/advisories/22452Vendor Advisory
• http://securitytracker.com/id?1017127Exploit, Patch, Vendor Advisory
• http://www.kb.cert.org/vuls/id/589272Patch, US Government Resource
• http://www.osvdb.org/31882
• http://www.securityfocus.com/bid/20704Exploit, Patch
• http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2007/0578Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29837
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A214

Published

Oct 27, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-5553Cisco Security Agent (CSA) for Linux 4.5 before 4.5.1.657 an…
• CVE-2006-5554Directory traversal vulnerability in index.php in Imageview …
• CVE-2006-5555PHP remote file inclusion vulnerability in constantes.inc.ph…
• CVE-2006-5556Buffer overflow in the localtime_r function, and certain oth…
• CVE-2006-5557Stack-based buffer overflow in the (1) swpackage and (2) swm…
• CVE-2006-5558Format string vulnerability in the swask command in HP-UX B.…
• CVE-2006-5560Cross-site scripting (XSS) vulnerability in heading.php in B…
• CVE-2006-5561SQL injection vulnerability in admincp.php in Discuz! GBK 5.…
• CVE-2006-5562PHP remote file inclusion vulnerability in include/database.…
• CVE-2006-5563Unspecified vulnerability in Yahoo! Messenger (Service 18) b…
• CVE-2006-5564Cross-site scripting (XSS) vulnerability in user.php in MAXd…
• CVE-2006-5565CRLF injection vulnerability in MAXdev MD-Pro 1.0.76 allows …