CVE-2007-2224
Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 34.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac, and Visual Basic 6.0 allows remote attackers to execute arbitrary code via the substringData method on a TextNode object, which causes an integer overflow that leads to a buffer overflow.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 34.53% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-189
- Affected
- microsoft/office · microsoft/visual basic
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/26449Vendor Advisory
- http://www.securityfocus.com/archive/1/476527/100/0/threaded
- http://www.securityfocus.com/bid/25282
- http://www.securitytracker.com/id?1018560
- http://www.us-cert.gov/cas/techalerts/TA07-226A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2867Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1248
- http://secunia.com/advisories/26449Vendor Advisory
- http://www.securityfocus.com/archive/1/476527/100/0/threaded
- http://www.securityfocus.com/bid/25282
- http://www.securitytracker.com/id?1018560
- http://www.us-cert.gov/cas/techalerts/TA07-226A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2867Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1248
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.