CVE-2007-3897

Published: Oct 9, 2007Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP responses that trigger memory corruption.

Affected (3)

Products: Microsoft: Outlook Express, Windows Mail

Microsoft

2 products

Outlook Express

Windows Mail

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Microsoft Outlook Express	Up to 6.0
Microsoft Outlook Express	Version 6.0 sp1
Microsoft Windows Mail	All versions

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (22)

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607

Source: secure@microsoft.com

Broken Link

http://secunia.com/advisories/27112

Source: secure@microsoft.com

Third Party Advisory

http://securitytracker.com/id?1018785

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://securitytracker.com/id?1018786

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/481983/100/100/threaded

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/482366/100/0/threaded

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/25908

Source: secure@microsoft.com

Third Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA07-282A.html

Source: secure@microsoft.com

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2007/3436

Source: secure@microsoft.com

Permissions RequiredThird Party Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-056

Source: secure@microsoft.com

PatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1706

Source: secure@microsoft.com

Third Party Advisory

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=607