CVE-2007-2227

Published: Jun 12, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "Content Disposition Parsing Cross Domain Information Disclosure Vulnerability."

Affected (2)

Products: Microsoft: Outlook Express, Windows Mail

2 products

Outlook Express

Configuration A

1 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Microsoft Outlook Express	Version 6.0

Running on/with	Platform Versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	Version sp1
Microsoft Windows 2003 Server	Version sp1
Microsoft Windows 2003 Server	Version sp2
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Configuration B

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Microsoft Windows Mail	All versions

Running on/with	Platform Versions
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions

References (26)

http://archive.openmya.devnull.jp/2007.06/msg00060.html

Source: secure@microsoft.com

http://openmya.hacker.jp/hasegawa/security/ms07-034.txt

Source: secure@microsoft.com

http://osvdb.org/35346

Source: secure@microsoft.com

http://secunia.com/advisories/25639

Source: secure@microsoft.com

http://www.securityfocus.com/archive/1/471947/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/archive/1/472002/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/bid/24410

Source: secure@microsoft.com

http://www.securitytracker.com/id?1018233

Source: secure@microsoft.com

http://www.securitytracker.com/id?1018234

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA07-163A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2007/2154

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2085

Source: secure@microsoft.com

http://archive.openmya.devnull.jp/2007.06/msg00060.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://openmya.hacker.jp/hasegawa/security/ms07-034.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/35346

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/25639

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/471947/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/472002/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/24410

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1018233

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1018234

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA07-163A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2007/2154

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2085

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.