PT-2007-3983 · Notepad+++1 · Notepad+++1

Vade79 · Publicado 2007-05-14 · Atualizado 2018-10-16 · CVE-2007-2666

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Scintilla versions 1.73 and earlier notepad++ versions 4.1.1 and earlier

Description A stack-based buffer overflow issue exists in the LexRuby.cxx file within the SciLexer.dll component of Scintilla, which is used by notepad++. This issue allows user-assisted remote attackers to execute arbitrary code via certain Ruby (.rb) files that contain long lines.

Recommendations For Scintilla version 1.73 and earlier, update to a version later than 1.73 to resolve the issue. For notepad++ version 4.1.1 and earlier, update to a version later than 4.1.1 to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-2666

Produtos afetados

Scintilla

Notepad++

Referências · 15

• 🔥 https://exploit-db.com/exploits/3912 · Exploit
• http://xforce.iss.net/xforce/xfdb/34372 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2666 · Nota de Segurança
• http://secunia.com/advisories/25327 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34269 · Nota
• http://scintilla.cvs.sourceforge.net/scintilla/scintilla/src/LexRuby.cxx?view=log#rev1.13 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34372 · Nota
• http://xforce.iss.net/xforce/xfdb/34269 · Nota
• http://securityfocus.com/archive/1/468529/100/0/threaded · Nota
• http://osvdb.org/36007 · Nota
• http://securityfocus.com/bid/23961 · Nota
• http://vupen.com/english/advisories/2007/1867 · Aviso do Fabricante
• http://securityfocus.com/archive/1/469348/100/100/threaded · Nota
• http://secunia.com/advisories/25245 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1794 · Aviso do Fabricante