9.3

CVE-2007-2223

Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
MicrosoftXml Core Services Version3.0
   MicrosoftWindows Server 2003
   MicrosoftWindows Server 2003 Version- Updatesp1
   MicrosoftWindows Server 2003 Version- Updatesp1 HwPlatformitanium
   MicrosoftWindows Server 2003 Version- Updatesp2
   MicrosoftWindows Vista Version- Editionx64
   MicrosoftWindows Vista Version- Editionx86
   MicrosoftWindows Vista Version- Updategold HwPlatformx64
   MicrosoftWindows Vista Version- Updatesp1 HwPlatformx64
   MicrosoftWindows Xp Version- SwEditionprofessional HwPlatformx64
   MicrosoftWindows Xp Version- Updatesp2
   MicrosoftWindows Xp Version- Updatesp2 SwEditionprofessional HwPlatformx64
   MicrosoftWindows Xp Version- Updatesp3
MicrosoftXml Core Services Version4.0
   MicrosoftWindows Server 2003
   MicrosoftWindows Server 2003 Version- Updatesp1
   MicrosoftWindows Server 2003 Version- Updatesp1 HwPlatformitanium
   MicrosoftWindows Server 2003 Version- Updatesp2
   MicrosoftWindows Vista Version- Editionx64
   MicrosoftWindows Vista Version- Editionx86
   MicrosoftWindows Vista Version- Updategold HwPlatformx64
   MicrosoftWindows Vista Version- Updatesp1 HwPlatformx64
   MicrosoftWindows Xp Version- SwEditionprofessional HwPlatformx64
   MicrosoftWindows Xp Version- Updatesp2
   MicrosoftWindows Xp Version- Updatesp2 SwEditionprofessional HwPlatformx64
   MicrosoftWindows Xp Version- Updatesp3
MicrosoftXml Core Services Version6.0
   MicrosoftWindows Server 2003
   MicrosoftWindows Server 2003 Version- Updatesp1
   MicrosoftWindows Server 2003 Version- Updatesp1 HwPlatformitanium
   MicrosoftWindows Server 2003 Version- Updatesp2
   MicrosoftWindows Vista Version- Editionx64
   MicrosoftWindows Vista Version- Editionx86
   MicrosoftWindows Vista Version- Updategold HwPlatformx64
   MicrosoftWindows Vista Version- Updatesp1 HwPlatformx64
   MicrosoftWindows Xp Version- SwEditionprofessional HwPlatformx64
   MicrosoftWindows Xp Version- Updatesp2
   MicrosoftWindows Xp Version- Updatesp2 SwEditionprofessional HwPlatformx64
   MicrosoftWindows Xp Version- Updatesp3
MicrosoftXml Core Services Version4.0
   MicrosoftWindows Server 2008 Version-
   MicrosoftWindows Server 2008 Version- HwPlatformitanium
MicrosoftXml Core Services Version5.0
   MicrosoftExpression Web
   MicrosoftOffice Version2003 Updatesp2
   MicrosoftOffice Version2007
   MicrosoftOffice Compatibility Pack Version2007
   MicrosoftOffice Groove Server Version2007
   MicrosoftOffice Sharepoint Server
   MicrosoftWord Viewer Version2003
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 68.2% 0.986
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.