CVE-2007-0025
published 2007-02-13CVE-2007-0025: The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote…
PriorityP351critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
36.51%
98.3th percentile
The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_studio_net | — | — |
| microsoft | visual_studio_net | — | — |
| microsoft | visual_studio_net | — | — |
| microsoft | windows_2003_server | — | — |
| microsoft | windows_2003_server | — | — |
| microsoft | windows_2003_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8mr8-j6c9-fwvf: Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Gold and SP1
ghsa_unreviewed·2022-05-01·CVSS 9.3
CVE-2007-1512 [CRITICAL] GHSA-8mr8-j6c9-fwvf: Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Gold and SP1
Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Gold and SP1, and Visual Studio .NET 2002 Gold and SP1, and 2003 Gold and SP1 allows user-assisted remote attackers to have an unknown impact (probably crash) via an RTF file with a malformed OLE object, which results in writing two 0x00 characters past the end of szBuffer, aka the "MFC42u.dll Off-by-Two Overflow." NOTE: this issue is due to an incomplete patch (MS07-012) for CVE-2007-0025.
GHSA
GHSA-gh84-chcq-ggcf: The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio
ghsa_unreviewed·2022-05-01
CVE-2007-0025 [HIGH] CWE-94 GHSA-gh84-chcq-ggcf: The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio
The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/24150http://www.kb.cert.org/vuls/id/932041http://www.osvdb.org/31887http://www.securityfocus.com/bid/22476http://www.securitytracker.com/id?1017638http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlhttp://www.vupen.com/english/advisories/2007/0581https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-012https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157http://secunia.com/advisories/24150http://www.kb.cert.org/vuls/id/932041http://www.osvdb.org/31887http://www.securityfocus.com/bid/22476http://www.securitytracker.com/id?1017638http://www.us-cert.gov/cas/techalerts/TA07-044A.htmlhttp://www.vupen.com/english/advisories/2007/0581https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-012https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A157
2007-02-13
Published