CVE-2007-2225

Published: Jun 12, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."

Affected (2)

Products: Microsoft: Outlook Express, Windows Mail

2 products

Outlook Express

Configuration A

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Microsoft Outlook Express	Version 6.0

Running on/with	Platform Versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	Version sp1
Microsoft Windows 2003 Server	Version sp1
Microsoft Windows 2003 Server	Version sp2
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Microsoft Windows Mail	All versions

Running on/with	Platform Versions
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions

References (28)

http://archive.openmya.devnull.jp/2007.06/msg00060.html

Source: secure@microsoft.com

http://openmya.hacker.jp/hasegawa/security/ms07-034.txt

Source: secure@microsoft.com

http://osvdb.org/35345

Source: secure@microsoft.com

http://secunia.com/advisories/25639

Source: secure@microsoft.com

http://www.kb.cert.org/vuls/id/682825

Source: secure@microsoft.com

US Government Resource

http://www.securityfocus.com/archive/1/471947/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/archive/1/472002/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/bid/24392

Source: secure@microsoft.com

http://www.securitytracker.com/id?1018231

Source: secure@microsoft.com

http://www.securitytracker.com/id?1018232

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA07-163A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2007/2154

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045

Source: secure@microsoft.com

http://archive.openmya.devnull.jp/2007.06/msg00060.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openmya.hacker.jp/hasegawa/security/ms07-034.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/35345

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/25639

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/682825

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.securityfocus.com/archive/1/471947/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/472002/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/24392

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1018231

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1018232

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA07-163A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2007/2154

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.