CVE-2007-5095

Windows Media Player 9 - Unauthenticated Remote Code Execution via HTMLView Parameter in ASX Files

Title source: llm
STIX 2.1

Description

Microsoft Windows Media Player (WMP) 9 on Windows XP SP2 invokes Internet Explorer to render HTML documents contained inside some media files, regardless of what default web browser is configured, which might allow remote attackers to exploit vulnerabilities in software that the user does not expect to run, as demonstrated by the HTMLView parameter in an .asx file.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/41093
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/479855/100/100/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/479854/100/100/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/479856/100/100/threaded
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/479825/100/100/threaded

Scores

EPSS 0.1517
EPSS Percentile 96.4%

Details

CWE
CWE-20
Status published
Products (1)
microsoft/windows_media_player 9
Published Sep 26, 2007
Tracked Since Feb 18, 2026