CVE-2007-0842: Medium severity Microsoft Visual C\+\+ vulnerability
The 64-bit versions of Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) time functions, including (1) localtime, (2) localtimes, (3) gmtime, (4) gmtimes, (5) ctime, (6) ctimes, (7) wctime, (8) wctimes, and (9) fstat, trigger an assertion error instead of a NULL pointer or EINVAL when processing a time argument later than Jan 1, 3000, which might allow context-dependent attackers to cause a denial of service (application exit) via large time values. NOTE: it could be argued that this is a design limitation of the functions, and the vulnerability lies with any application that does not validate arguments to these functions. However, this behavior is inconsistent with documentation, which does not list assertions as a possible result of an error condition.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0842?
CVE-2007-0842 is classified as a vulnerability that can lead to assertion errors in specific time functions of the Microsoft Visual C++ 8.0 standard library.
How do I fix CVE-2007-0842?
To fix CVE-2007-0842, update to a patched version of Microsoft Visual C++ or Visual Studio that addresses this vulnerability.
Which versions of Microsoft Visual C++ are affected by CVE-2007-0842?
CVE-2007-0842 affects the 64-bit versions of Microsoft Visual C++ 8.0 and Microsoft Visual Studio 2005.
What functions are involved in CVE-2007-0842?
CVE-2007-0842 involves the localtime, localtime_s, gmtime, gmtime_s, ctime, ctime_s, wctime, wctime_s, and fstat functions.
What happens when the affected functions are called in CVE-2007-0842?
When the affected functions are called, CVE-2007-0842 triggers an assertion error instead of returning a NULL pointer or EINVAL.