vulnwire
9.3crit

CVE-2007-1891

Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadMana…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.8%
percentile 94%
Public exploits
0
none known

Stack-based buffer overflow in the GetPrivateProfileSectionW function in Akamai Technologies Download Manager ActiveX Control (DownloadManagerV2.ocx) after 2.0.4.4 but before 2.2.1.0 allows remote attackers to execute arbitrary code, related to misinterpretation of the nSize parameter as a byte count instead of a wide character count.

Exploit prediction (EPSS)

6.77% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

References

  • labs.idefense.com /intelligence/vulnerabilities/display.php?id=514 · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • osvdb.org /34323 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/465908/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/24900 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1017925 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • kb.cert.org /vuls/id/120241 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • vupen.com /english/advisories/2007/1415 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /bid/23522 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.