CVE-2007-2225: Medium severity Microsoft Windows 2003 Server vulnerability
Published Jun 12, 2007
·Updated
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
Affected Software
12 affected components
Microsoft Windows 2003 Server
Microsoft Windows 2003 Server=sp2
Microsoft Windows 2003 Server=sp1
Microsoft Windows 2003 Server=sp1
Microsoft Windows 2003 Server=sp2
Microsoft Windows XP
Microsoft Windows XP=sp2
Microsoft Windows XP=sp2
Microsoft Outlook Express=6.0
Microsoft Windows Vista=gold
Microsoft Windows Vista=gold
Microsoft Windows Mail
Event History
Jun 12, 2007
CVE Published
08:30 PM
Data Sourced
08:30 PM
DescriptionWeaknessAffected Software
Jun 13, 2007
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2225?
CVE-2007-2225 is classified as a moderate severity vulnerability.
2
How does CVE-2007-2225 exploit HTTP headers?
CVE-2007-2225 exploits improper handling of certain HTTP headers in MHTML protocol URLs.
3
Which software is affected by CVE-2007-2225?
CVE-2007-2225 affects Microsoft Outlook Express 6 and Windows Mail in Windows Vista.
4
How can I mitigate CVE-2007-2225?
Mitigating CVE-2007-2225 involves applying the latest security updates from Microsoft for the affected software.
5
What type of attack does CVE-2007-2225 facilitate?
CVE-2007-2225 facilitates cross-domain information disclosure attacks.