Vulnerability Description
Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execute arbitrary code via a crafted ActiveX object that triggers memory corruption, as demonstrated via the ModeName parameter to the FindEngine function in ACTIVEVOICEPROJECTLib.DirectSS.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 2000 | All versions |
| Microsoft | Internet Explorer | 5.01 |
| Microsoft | Windows 2003 Server | sp1 |
| Microsoft | Windows Xp | All versions |
| Microsoft | Windows Vista | All versions |
Related Weaknesses (CWE)
References
- http://osvdb.org/35353
- http://retrogod.altervista.org/win_speech_2k_sp4.html
- http://retrogod.altervista.org/win_speech_xp_sp2.html
- http://secunia.com/advisories/25627Vendor Advisory
- http://securitytracker.com/id?1018235
- http://www.exploit-db.com/exploits/4065
- http://www.kb.cert.org/vuls/id/507433US Government Resource
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/bid/24426
- http://www.us-cert.gov/cas/techalerts/TA07-163A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2153Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-03
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34630
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://osvdb.org/35353
FAQ
What is CVE-2007-2222?
CVE-2007-2222 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple buffer overflows in the (1) ActiveListen (Xlisten.dll) and (2) ActiveVoice (Xvoice.dll) speech controls, as used by Microsoft Internet Explorer 5.01, 6, and 7, allow remote attackers to execu...
How severe is CVE-2007-2222?
CVE-2007-2222 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-2222?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows 2000, Microsoft Internet Explorer, Microsoft Windows 2003 Server, Microsoft Windows Xp, Microsoft Windows Vista.