Buffer overflow in Businessobjects Crystal Reports Xi
CVE-2006-6133
Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.6 (High). Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.520 (98.9th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 98.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.520 · newest: 0.520 · change: 0.000
Affected products
- Businessobjects Crystal Reports Xi
- Microsoft Visual Studio .Net — versions 2002, 2003, 2005
Weakness classification (CWE)
References
- securitytracker.com/id (vdb-entry)
- www.vupen.com/english/advisories/2007/3114 (vdb-entry, Vendor Advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/30532 (vdb-entry)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:2055 (signature, vdb-entry)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-052 (vendor-advisory)
- secunia.com/advisories/26754 (Vendor Advisory, third-party-advisory)
- secunia.com/advisories/23091 (Vendor Advisory, third-party-advisory)
- www.vupen.com/english/advisories/2006/4691 (vdb-entry, Vendor Advisory)
- www.us-cert.gov/cas/techalerts/TA07-254A.html (US Government Resource, third-party-advisory)
- www.securityfocus.com/bid/21261 (vdb-entry)