1. CVE-Search
  2. CVE-2007-5133
ID CVE-2007-5133
Summary Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service (CPU consumption) via a certain PNG file with a large tEXt chunk that possibly triggers an integer overflow in PNG chunk size handling, as demonstrated by badlycrafted.png.
References
Vulnerable Configurations
  • cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:x64-std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:*:x64-std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:xp-64bit:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:*:xp-64bit:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2003:*:-:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:gold:wed:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:gold:wed:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2003:*:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:gold:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:gold:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:*:std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:gold:tablet_pc:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:gold:tablet_pc:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:64bit:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:64bit:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:x64-home_basic:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:x64-home_basic:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:media_center:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:*:itanium:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:business:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:business:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:embedded:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:embedded:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:media_center:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:pro:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:pro:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:gold:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:gold:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:enterprise:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:enterprise:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:r2:std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:r2:std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:starter:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:starter:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:tablet_pc:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:tablet_pc:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:r2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:r2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:embedded:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:embedded:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:x64-business:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:x64-business:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:gold:std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:gold:std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp1:wed:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp1:wed:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:gold:x64-std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:gold:x64-std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:gold:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:gold:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:r2:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:r2:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:ibm_oem:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:ibm_oem:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:gold:media_center:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:gold:media_center:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:embedded:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:embedded:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:gold:pro:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:gold:pro:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:wed:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:*:wed:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:r2:x64-std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:r2:x64-std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:tablet_pc:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:gold:itanium:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:gold:itanium:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:ibm_oem:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:ibm_oem:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:pro:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:pro:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:r2:wed:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:r2:wed:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:home_basic:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:home_basic:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:tablet_pc:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:wed:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp2:wed:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:home_premium:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:home_premium:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:ultimate:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:ultimate:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp2:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp1:std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp1:std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:media_center:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_2003_server:*:sp2:std:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_2003_server:*:sp2:std:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:gold:embedded:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:gold:embedded:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:gold:x64:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:gold:x64:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:sp1:pro:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:sp1:pro:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:*:64bit:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:*:64bit:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_xp:*:gold:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_xp:*:gold:*:*:*:*:*:*
  • cpe:2.3:a:3ware:3dm_disk_management_software:*:sp1:*:*:*:*:*:*
    cpe:2.3:a:3ware:3dm_disk_management_software:*:sp1:*:*:*:*:*:*
  • cpe:2.3:a:3ware:3dm_disk_management_software:*:sp2:*:*:*:*:*:*
    cpe:2.3:a:3ware:3dm_disk_management_software:*:sp2:*:*:*:*:*:*
CVSS
Base: 7.1 (as of 07-07-2021 - 16:10)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:N/A:C
refmap via4
bid 25816
bugtraq
  • 20070925 Possible Windows Explorer bad PNG file preview integer overflow handling
  • 20070926 Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling
  • 20070927 Re: Possible Windows Explorer bad PNG file preview integer overflow handling
  • 20070927 Re: Re: Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling
  • 20070927 Re: Re: Re: Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling
osvdb 45521
Last major update 07-07-2021 - 16:10
Published 27-09-2007 - 19:17
Last modified 07-07-2021 - 16:10
Back to Top