CVE-2007-3897

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

Score

CVSS 2.0 9.3 Critical

Status

Modified - secure@microsoft.com

Published

2007-10-09

Last modified

2024-08-07

Weaknesses

CWE-119

Affected products

• Outlook Express (Microsoft)
• Windows Mail (Microsoft)

References

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607
• http://secunia.com/advisories/27112
• http://securitytracker.com/id?1018785
• http://securitytracker.com/id?1018786
• http://www.securityfocus.com/archive/1/481983/100/100/threaded
• http://www.securityfocus.com/archive/1/482366/100/0/threaded
• http://www.securityfocus.com/bid/25908
• http://www.us-cert.gov/cas/techalerts/TA07-282A.html
• http://www.vupen.com/english/advisories/2007/3436
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706