CVE-2007-2223

CRITICAL 9.3CVE-2007-2223 · Published 14/08/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
xml core services microsoft	`= 3.0= 4.0= 5.0= 6.0`	No fix yet

Description

Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1) TextNode or (2) XMLDOM object, which causes an integer overflow that leads to a buffer overflow.

References

labs.idefense.com/intelligence/vulnerabilities/display.php · Broken Link
secunia.com/advisories/26447 · Vendor Advisory
kb.cert.org/vuls/id/361968 · Third Party Advisory
securityfocus.com/archive/1/476527/100/0/threaded · Third Party Advisory
securityfocus.com/archive/1/476747/100/0/threaded · Third Party Advisory
securityfocus.com/bid/25301 · Third Party Advisory
securitytracker.com/id · Third Party Advisory
vupen.com/english/advisories/2007/2866 · Vendor Advisory
zerodayinitiative.com/advisories/ZDI-07-048 · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-042 · Patch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2069 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free