CVE-2007-2216

2007-08-1421:17:00

CWE-16

microsoft

web.nvd.nist.gov

tblinf32.dll

vstlbinf.dll

activex control

internet explorer

remote code execution

dll file vulnerability

nvd

cve-2007-2216

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.3

Confidence

Low

EPSS

0.945

Percentile

99.3%

JSON

The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka “ActiveX Object Vulnerability.”

Affected configurations

Nvd

Node

microsoftinternet_explorerMatch5.01

microsoftinternet_explorerMatch6sp1

microsoftinternet_explorerMatch7

VendorProductVersionCPE
microsoftinternet_explorer5.01cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
microsoftinternet_explorer6cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
microsoftinternet_explorer7cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	internet_explorer	5.01	cpe:2.3:a:microsoft:internet_explorer:5.01:::::::*
microsoft	internet_explorer	6	cpe:2.3:a:microsoft:internet_explorer:6:sp1::::::
microsoft	internet_explorer	7	cpe:2.3:a:microsoft:internet_explorer:7:::::::*