Multiple ActiveX controls in Microsoft Windows 2000 XP 2003 and Vista allows remote attackers to cause a denial of service (Internet Explorer crash) by accessing the bgColor fgColor linkColor alinkColor vlinkColor or defaultCharset properties in the (1) giffile (2) htmlfile (3) jpegfile (4) mhtmlfile (5) ODCfile (6) pjpegfile (7) pngfile (8) xbmfile (9) xmlfile (10) xslfile or (11) wdfile objects in (a) mshtml.dll; or the (12) TriEditDocument.TriEditDocument or (13) TriEditDocument.TriEditDocument.1 objects in (b) triedit.dll which cause a NULL pointer dereference.