Unscored severity · published Jun 12, 2007
CVE-2007-2225
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote…
–
CVSS
25%
EPSS
No
On KEV
Description
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)25.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Outlook Express · Microsoft
6.0 · source: NVD
WM
Windows Mail · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2225
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2225
archive.openmya.devnull.jp
http://archive.openmya.devnull.jp/2007.06/msg00060.html
openmya.hacker.jp
http://openmya.hacker.jp/hasegawa/security/ms07-034.txt
osvdb.org
http://osvdb.org/35345
secunia.com
http://secunia.com/advisories/25639
US Government Resource
http://www.kb.cert.org/vuls/id/682825
www.securityfocus.com
http://www.securityfocus.com/archive/1/471947/100/0/threaded
More from Outlook Express
8.8
CVE-2007-4040
Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting…
–
CVE-2010-3147
Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2,…
–
CVE-2010-0816
Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008…
–
CVE-2008-5424
The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts…
–
CVE-2008-1448
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to…