9.3

CVE-2007-1201

Unspecified vulnerability in certain COM objects in Microsoft Office Web Components 2000 allows user-assisted remote attackers to execute arbitrary code via vectors related to DataSource that trigger memory corruption, aka "Office Web Components DataSource Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Biztalk Server Version 2000
Microsoft ≫ Biztalk Server Version 2002
Microsoft ≫ Commerce Server Version 2000
Microsoft ≫ Office Version 2000 Update sp3
Microsoft ≫ Office Version xp Update sp3
Microsoft ≫ Visual Studio .Net Version 2002 Update sp1
Microsoft ≫ Visual Studio .Net Version 2003 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 28.73% 0.979
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://marc.info/?l=bugtraq&m=120585858807305&w=2
http://secunia.com/advisories/29328
Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA08-071A.html
US Government Resource
http://www.vupen.com/english/advisories/2008/0849/references
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-017
http://www.securityfocus.com/bid/28136
Patch
http://www.securitytracker.com/id?1019581
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5327