Login Request a demo
Unscored severity · published Oct 9, 2007
CVE-2007-3897
Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary…
–
CVSS
54.6%
EPSS
No
On KEV
Description
Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.
Exploitation
Is it being used?
Exploit prediction (EPSS)54.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Outlook Express · Microsoft
through 6.0; 6.0 · source: NVD
WM
Windows Mail · Microsoft
All versions, or not specified · source: NVD
Affected product
OE
Outlook Express
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3897
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3897
Broken Link
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607
Third Party Advisory
http://secunia.com/advisories/27112
Third Party Advisory
http://securitytracker.com/id?1018785
Third Party Advisory
http://securitytracker.com/id?1018786
Third Party Advisory
http://www.securityfocus.com/archive/1/481983/100/100/threaded
Third Party Advisory
http://www.securityfocus.com/archive/1/482366/100/0/threaded
More from Outlook Express
8.8
CVE-2007-4040
Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting…
–
CVE-2010-3147
Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2,…
–
CVE-2010-0816
Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008…
–
CVE-2008-5424
The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts…
–
CVE-2008-1448
The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to…