Internet Explorer 4.x was found to be vulnerable to a bug where if malicious user places in a <img> tag a height or a width variable with the value of a very long string of zeroes Internet Explorer crashes.
Because Internet Explorer stores the value presented by the width/height variable in an enclosed buffer (it's size isn't dynamic, and can be overflowed) and the value doesn't exist the maximum size of the parameter, Internet Explorer will continue and read the string until it overwrites information stored after the location of the buffer, causing a crash.
There seems to be other variables needed in order to recreate the crash, such as disabling Internet Explorer's option of caching the loaded page, and the creating of a blank page with the <img> tag.
The bug can be reproduced on IE 4.0 (4.71.1712.6) and 4.01SP1 (4.72.3110.8).
