CVE-2007-3897: microsoft outlook_express

CVSS: 9.3v2.0HighModified

Published 09-10-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-3897 is a high (CVSS 9.3) vulnerability in microsoft outlook_express. EPSS estimates a 54.63% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

54.63%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

09-10-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

54.63%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 54.63% on 18-09-2026

18-09-202618-10-2026

EPSS score

54.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Microsoft2 products

outlook_express≤ 6.0 | 6.0:sp1
windows_mailna

1 vendor · 2 products

References

11 links

securitytracker.com/id?1018785VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/archive/1/482366/100/0/threadedVendor AdvisoryX Refsource HPThird Party AdvisoryVDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706VDB EntrySignatureX Refsource OVALThird Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056Vendor AdvisoryX Refsource MSPatch
www.securityfocus.com/archive/1/481983/100/100/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
labs.idefense.com/intelligence/vulnerabilities/display.php?id=607Third Party AdvisoryX Refsource IDEFENSEBroken Link
www.vupen.com/english/advisories/2007/3436VDB EntryX Refsource VUPENPermissions RequiredThird Party Advisory
securitytracker.com/id?1018786VDB EntryX Refsource SECTRACKThird Party Advisory
www.securityfocus.com/bid/25908VDB EntryX Refsource BIDThird Party Advisory
www.us-cert.gov/cas/techalerts/TA07-282A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource

Show all 11 references

secunia.com/advisories/27112Third Party AdvisoryX Refsource SECUNIA

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities