VulnerabilityModified

CVE-2007-0025

HIGH 9.3EPSS 36.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 36.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 36.73% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: microsoft/visual studio .net · microsoft/windows 2003 server
Source: secure@microsoft.com

References

http://secunia.com/advisories/24150Vendor Advisory
http://www.kb.cert.org/vuls/id/932041US Government Resource
http://www.osvdb.org/31887
http://www.securityfocus.com/bid/22476
http://www.securitytracker.com/id?1017638
http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2007/0581Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-012
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157
http://secunia.com/advisories/24150Vendor Advisory
http://www.kb.cert.org/vuls/id/932041US Government Resource
http://www.osvdb.org/31887
http://www.securityfocus.com/bid/22476
http://www.securitytracker.com/id?1017638
http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2007/0581Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-012
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.