CVE-2007-2222
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 54.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 54.74% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/internet explorer
- Source
- secure@microsoft.com
References
- http://osvdb.org/35353
- http://retrogod.altervista.org/win_speech_2k_sp4.html
- http://retrogod.altervista.org/win_speech_xp_sp2.html
- http://secunia.com/advisories/25627Vendor Advisory
- http://securitytracker.com/id?1018235
- http://www.exploit-db.com/exploits/4065
- http://www.kb.cert.org/vuls/id/507433US Government Resource
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/bid/24426
- http://www.us-cert.gov/cas/techalerts/TA07-163A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2153Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34630
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2031
- http://osvdb.org/35353
- http://retrogod.altervista.org/win_speech_2k_sp4.html
- http://retrogod.altervista.org/win_speech_xp_sp2.html
- http://secunia.com/advisories/25627Vendor Advisory
- http://securitytracker.com/id?1018235
- http://www.exploit-db.com/exploits/4065
- http://www.kb.cert.org/vuls/id/507433US Government Resource
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/bid/24426
- http://www.us-cert.gov/cas/techalerts/TA07-163A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2153Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-033
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34630
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2031
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.