Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-2222 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Internet Explorer

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents3 sources
Severity
9.3CRITICALNVD
EPSS
63.6%
top 1.58%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Internet Explorer
Timeline
PublishedJun 12
Latest updateMay 1

Description

Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/internet_explorer5.01, 6, 7.0+2

🔴Vulnerability Details

1
GHSA
GHSA-j9hq-mqc5-42vq: Multiple buffer overflows in the (1) ActiveListen (Xlisten↗2022-05-01
▶

💥Exploits & PoCs

3
Exploit-DB
Microsoft Speech API ActiveX Control (Windows XP SP2) - Remote Buffer Overflow (MS07-033)↗2007-06-13
▶
Exploit-DB
Microsoft Speech API ActiveX Control (Windows 2000 SP4) - Remote Buffer Overflow (MS07-033)↗2007-06-13
▶
Exploit-DB
XOOPS Module WF-Section 1.01 - 'articleId' SQL Injection↗2007-04-02
▶
CVE-2007-2222 — Microsoft vulnerability | cvebase