Vulnerability Details : CVE-2007-3897

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

Vulnerability category: OverflowMemory CorruptionExecute code

Published 2007-10-09 22:17:00

Updated 2019-10-09 22:53:31

Source Microsoft Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2007-3897

Probability of exploitation activity in the next 30 days: 95.51%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2007-3897

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2007-3897

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: [email protected] (Primary)

References for CVE-2007-3897

http://www.securityfocus.com/bid/25908

Third Party Advisory;VDB Entry
http://www.securityfocus.com/archive/1/482366/100/0/threaded

Third Party Advisory;VDB Entry

CVEs referencing this url
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607

Broken Link
http://www.us-cert.gov/cas/techalerts/TA07-282A.html

Third Party Advisory;US Government Resource

CVEs referencing this url
http://www.securityfocus.com/archive/1/481983/100/100/threaded

Third Party Advisory;VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706

Third Party Advisory
http://securitytracker.com/id?1018785

Third Party Advisory;VDB Entry
http://www.vupen.com/english/advisories/2007/3436

Permissions Required;Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056

Patch;Vendor Advisory
http://securitytracker.com/id?1018786

Third Party Advisory;VDB Entry

Products affected by CVE-2007-3897

Microsoft » Outlook Express
Versions up to, including, (<=) 6.0
cpe:2.3:a:microsoft:outlook_express:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Outlook Express » Version: 6.0 Update SP1
cpe:2.3:a:microsoft:outlook_express:6.0:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Windows Mail » Version: N/A For Vista
cpe:2.3:a:microsoft:windows_mail:-:*:*:*:*:vista:*:*
Matching versions