Unscored severity · published Oct 1, 2007
CVE-2007-5144
Buffer overflow in the GDI engine in Windows Live Messenger, as used for Windows MSN Live 8.1, allows user-assisted remote attackers to cause a denial of service (application…
–
CVSS
16.5%
EPSS
No
On KEV
Description
Buffer overflow in the GDI engine in Windows Live Messenger, as used for Windows MSN Live 8.1, allows user-assisted remote attackers to cause a denial of service (application crash or system crash) and possibly execute arbitrary code by placing a malformed file in a new folder under the Sharing Folders path, and triggering a synchronize operation through the Windows MSN Live online service, possibly related to extended file attributes and possibly related to an incomplete fix for MS07-046, as demonstrated by a (1) .jpg, (2) .gif, (3) .wmf, (4) .doc, or (5) .ico file.
Exploitation
Is it being used?
Exploit prediction (EPSS)16.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
Windows Live Messenger · Microsoft
8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5144
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5144
lostmon.blogspot.com
http://lostmon.blogspot.com/2007/09/windows-live-messenger-jpg-overflow.html
osvdb.org
http://osvdb.org/45523
www.securityfocus.com
http://www.securityfocus.com/bid/25795
More from Windows Live Messenger
–
CVE-2010-0278
A certain ActiveX control in msgsc.14.0.8089.726.dll in Microsoft Windows Live Messenger 2009 build 14.0.8089.726 on Windows Vista and Windows 7 allows remote attackers to cause a…
–
CVE-2009-0647
msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a…
–
CVE-2008-5828
Microsoft Windows Live Messenger Client 8.5.1 and earlier, when MSN Protocol Version 15 (MSNP15) is used over a NAT session, allows remote attackers to discover intranet IP…
–
CVE-2008-5179
Unspecified vulnerability in Microsoft Office Communications Server (OCS), Office Communicator, and Windows Live Messenger allows remote attackers to cause a denial of service…
–
CVE-2007-2931
Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to execute arbitrary code via unspecified…