Unscored severity · published Jun 12, 2007
CVE-2007-2227
The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote…
–
CVSS
25%
EPSS
No
On KEV
Description
The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)25.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Outlook Express · Microsoft
6.0 · source: NVD
WM
Windows Mail · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2227
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2227
archive.openmya.devnull.jp
http://archive.openmya.devnull.jp/2007.06/msg00060.html
openmya.hacker.jp
http://openmya.hacker.jp/hasegawa/security/ms07-034.txt
osvdb.org
http://osvdb.org/35346
secunia.com
http://secunia.com/advisories/25639
www.securityfocus.com
http://www.securityfocus.com/archive/1/471947/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/archive/1/472002/100/0/threaded
More from Outlook Express
8.8
CVE-2007-4040
Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting…
–
CVE-2010-3147
Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2,…
–
CVE-2010-0816
Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008…
–
CVE-2008-5424
The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts…
–
CVE-2008-1448
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to…