CVE-2007-0025

2007-02-1320:28:00

CWE-94

[email protected]

web.nvd.nist.gov

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

Low

EPSS

0.615

Percentile

97.9%

JSON

The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.

Affected configurations

Nvd

Node

microsoftvisual_studio_.netMatch2000

microsoftvisual_studio_.netMatch2000sp1

microsoftvisual_studio_.netMatch2003gold

Node

microsoftwindows_2003_serverMatch2000sp4

microsoftwindows_2003_serverMatch2003sp2

microsoftwindows_2003_serverMatchxp_sp2

VendorProductVersionCPE
microsoftvisual_studio_.net2000cpe:2.3:a:microsoft:visual_studio_.net:2000:*:*:*:*:*:*:*
microsoftvisual_studio_.net2000cpe:2.3:a:microsoft:visual_studio_.net:2000:sp1:*:*:*:*:*:*
microsoftvisual_studio_.net2003cpe:2.3:a:microsoft:visual_studio_.net:2003:gold:*:*:*:*:*:*
microsoftwindows_2003_server2000cpe:2.3:o:microsoft:windows_2003_server:2000:sp4:*:*:*:*:*:*
microsoftwindows_2003_server2003cpe:2.3:o:microsoft:windows_2003_server:2003:sp2:*:*:*:*:*:*
microsoftwindows_2003_serverxp_sp2cpe:2.3:o:microsoft:windows_2003_server:xp_sp2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	visual_studio_.net	2000	cpe:2.3:a:microsoft:visual_studio_.net:2000:::::::*
microsoft	visual_studio_.net	2000	cpe:2.3:a:microsoft:visual_studio_.net:2000:sp1::::::
microsoft	visual_studio_.net	2003	cpe:2.3:a:microsoft:visual_studio_.net:2003:gold::::::
microsoft	windows_2003_server	2000	cpe:2.3:o:microsoft:windows_2003_server:2000:sp4::::::
microsoft	windows_2003_server	2003	cpe:2.3:o:microsoft:windows_2003_server:2003:sp2::::::
microsoft	windows_2003_server	xp_sp2	cpe:2.3:o:microsoft:windows_2003_server:xp_sp2:::::::*