CVE-2007-1754

Microsoft Publisher 2007 - Remote Code Execution via Malformed .pub File

Title source: llm

Description

PUBCONV.DLL in Microsoft Office Publisher 2007 does not properly clear memory when transferring data from disk to memory, which allows user-assisted remote attackers to execute arbitrary code via a malformed .pub page via a certain negative value, which bypasses a sanitization procedure that initializes critical pointers to NULL, aka the "Publisher Invalid Memory Reference Vulnerability".

References (10)

Core 10

Core References

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-037

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2007/2479

Various Sources vendor-advisory x_refsource_hp

http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html

Various Sources x_refsource_misc

http://research.eeye.com/html/advisories/published/AD20070710.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1018353

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1871

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA07-191A.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/25988

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/35953

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/473309/100/0/threaded

Scores

EPSS 0.3278

EPSS Percentile 98.2%

Details

CWE

CWE-399

Status published

Products (1)

microsoft/publisher 2007

Published Jul 10, 2007

Tracked Since Feb 18, 2026