CVE-2007-1512

2007-03-2010:19:00

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.9

Confidence

Low

EPSS

0.615

Percentile

97.9%

JSON

Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Gold and SP1, and Visual Studio .NET 2002 Gold and SP1, and 2003 Gold and SP1 allows user-assisted remote attackers to have an unknown impact (probably crash) via an RTF file with a malformed OLE object, which results in writing two 0x00 characters past the end of szBuffer, aka the “MFC42u.dll Off-by-Two Overflow.” NOTE: this issue is due to an incomplete patch (MS07-012) for CVE-2007-0025.

Affected configurations

Nvd

Node

microsoftwindows_2000sp4

microsoftwindows_2003_serverMatchgold

microsoftwindows_2003_serverMatchsp1

microsoftwindows_xpsp2

AND

microsoftvisual_studio_.netMatch2002gold

microsoftvisual_studio_.netMatch2002sp1

microsoftvisual_studio_.netMatch2003gold

microsoftvisual_studio_.netMatch2003sp1

VendorProductVersionCPE
microsoftwindows_2000*cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
microsoftwindows_2003_servergoldcpe:2.3:o:microsoft:windows_2003_server:gold:*:*:*:*:*:*:*
microsoftwindows_2003_serversp1cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoftvisual_studio_.net2002cpe:2.3:a:microsoft:visual_studio_.net:2002:gold:*:*:*:*:*:*
microsoftvisual_studio_.net2002cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*
microsoftvisual_studio_.net2003cpe:2.3:a:microsoft:visual_studio_.net:2003:gold:*:*:*:*:*:*
microsoftvisual_studio_.net2003cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_2000	*	cpe:2.3:o:microsoft:windows_2000::sp4::::::*
microsoft	windows_2003_server	gold	cpe:2.3:o:microsoft:windows_2003_server:gold:::::::*
microsoft	windows_2003_server	sp1	cpe:2.3:o:microsoft:windows_2003_server:sp1:::::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
microsoft	visual_studio_.net	2002	cpe:2.3:a:microsoft:visual_studio_.net:2002:gold::::::
microsoft	visual_studio_.net	2002	cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1::::::
microsoft	visual_studio_.net	2003	cpe:2.3:a:microsoft:visual_studio_.net:2003:gold::::::
microsoft	visual_studio_.net	2003	cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1::::::