VulnerabilityModified
CVE-2007-3895
Buffer overflow in Microsoft DirectShow in Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted (1) WAV or (2) AVI file.
HIGH 9.3EPSS 36.2%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 36.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Buffer overflow in Microsoft DirectShow in Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafted (1) WAV or (2) AVI file.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 36.23% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/directx
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/28010Patch, Vendor Advisory
- http://www.iss.net/threats/280.html
- http://www.kb.cert.org/vuls/id/321233US Government Resource
- http://www.securityfocus.com/archive/1/485268/100/0/threaded
- http://www.securityfocus.com/bid/26804
- http://www.securitytracker.com/id?1019073
- http://www.us-cert.gov/cas/techalerts/TA07-345A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/4180Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-064
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38722
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4287
- http://secunia.com/advisories/28010Patch, Vendor Advisory
- http://www.iss.net/threats/280.html
- http://www.kb.cert.org/vuls/id/321233US Government Resource
- http://www.securityfocus.com/archive/1/485268/100/0/threaded
- http://www.securityfocus.com/bid/26804
- http://www.securitytracker.com/id?1019073
- http://www.us-cert.gov/cas/techalerts/TA07-345A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/4180Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-064
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38722
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4287
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.