Back to CVE Browser

CVE-2007-0217

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1870%

EPSS Percentile40.68th

PublishedFeb 13, 2007

Last ModifiedApr 23, 2026

Vulnerability Description

The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.

Affected Platforms (CPE)

📦

Microsoft

Internet Explorer

= 5.01

📦

Microsoft

Ie

= 6.0

📦

Microsoft

Internet Explorer

= 6.0

References & Advisories

🔗 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=473

🔗 http://secunia.com/advisories/24156

🔗 http://www.kb.cert.org/vuls/id/613564

🔗 http://www.osvdb.org/31892

🔗 http://www.securityfocus.com/archive/1/462303/100/0/threaded

🔗 http://www.securityfocus.com/bid/22489

🔗 http://www.securitytracker.com/id?1017642

🔗 http://www.us-cert.gov/cas/techalerts/TA07-044A.html

Related Vulnerabilities

CVE-1999-046510.0

Remote attackers can crash Lynx and Internet Explorer using an IMG tag with a large width parameter.

CVE-1999-034710.0

Internet Explorer 4.01 allows remote attackers to read local files and spoof web pages via a "%01" character in an "about:" Javasc...

CVE-1999-096710.0

Buffer overflow in the HTML library used by Internet Explorer, Outlook Express, and Windows Explorer via the res: local resource p...

CVE-1999-124110.0

Internet Explorer, with a security setting below Medium, allows remote attackers to execute arbitrary commands via a malicious web...