PT-2007-3983 · Notepad+++1 · Notepad+++1

Vade79 · Published 2007-05-14 · Updated 2018-10-16 · CVE-2007-2666

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Scintilla versions 1.73 and earlier notepad++ versions 4.1.1 and earlier

Description A stack-based buffer overflow issue exists in the LexRuby.cxx file within the SciLexer.dll component of Scintilla, which is used by notepad++. This issue allows user-assisted remote attackers to execute arbitrary code via certain Ruby (.rb) files that contain long lines.

Recommendations For Scintilla version 1.73 and earlier, update to a version later than 1.73 to resolve the issue. For notepad++ version 4.1.1 and earlier, update to a version later than 4.1.1 to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-2666

Affected Products

Scintilla

Notepad++

References · 15

• 🔥 https://exploit-db.com/exploits/3912 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2666 · Security Note
• http://vupen.com/english/advisories/2007/1867 · Vendor Advisory
• http://secunia.com/advisories/25245 · Vendor Advisory
• http://vupen.com/english/advisories/2007/1794 · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/34372 · Note
• http://secunia.com/advisories/25327 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34269 · Note
• http://scintilla.cvs.sourceforge.net/scintilla/scintilla/src/LexRuby.cxx?view=log#rev1.13 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34372 · Note
• http://xforce.iss.net/xforce/xfdb/34269 · Note
• http://securityfocus.com/archive/1/468529/100/0/threaded · Note
• http://osvdb.org/36007 · Note
• http://securityfocus.com/bid/23961 · Note
• http://securityfocus.com/archive/1/469348/100/100/threaded · Note