{"api_version":"1","generated_at":"2026-07-23T08:55:25+00:00","cve":"CVE-2007-4336","urls":{"html":"https://cve.report/CVE-2007-4336","api":"https://cve.report/api/cve/CVE-2007-4336.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-4336","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-4336"},"summary":{"title":"CVE-2007-4336","description":"Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-08-14 18:17:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2007/2857","name":"http://www.vupen.com/english/advisories/2007/2857","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/26426","name":"http://secunia.com/advisories/26426","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Microsoft DirectX Media SDK FlashPix ActiveX Control Buffer Overflow - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1018551","name":"http://www.securitytracker.com/id?1018551","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft DirectX Buffer Overflow in FlashPix ActiveX Control Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/466601","name":"http://www.kb.cert.org/vuls/id/466601","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"VU#466601 - Microsoft DirectX Media 6.0 Live Picture Corporation DirectTransform FlashPix ActiveX control buffer overflow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/25279","name":"http://www.securityfocus.com/bid/25279","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft DirectX Media SDK DXTLIPI.DLL ActiveX Control Buffer Overflow Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/4279","name":"https://www.exploit-db.com/exploits/4279","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft DXMedia SDK 6 (SourceUrl) ActiveX Remote Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35970","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35970","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/36399","name":"http://osvdb.org/36399","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-4336","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-4336","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"4336","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"directx_media","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T14:53:54.861Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"directx-dxtlipi-bo(35970)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35970"},{"name":"4279","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/4279"},{"name":"ADV-2007-2857","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/2857"},{"name":"VU#466601","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/466601"},{"name":"25279","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/25279"},{"name":"26426","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/26426"},{"name":"36399","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/36399"},{"name":"1018551","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1018551"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-08-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"directx-dxtlipi-bo(35970)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35970"},{"name":"4279","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/4279"},{"name":"ADV-2007-2857","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/2857"},{"name":"VU#466601","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/466601"},{"name":"25279","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/25279"},{"name":"26426","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/26426"},{"name":"36399","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/36399"},{"name":"1018551","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1018551"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-4336","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"directx-dxtlipi-bo(35970)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35970"},{"name":"4279","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/4279"},{"name":"ADV-2007-2857","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/2857"},{"name":"VU#466601","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/466601"},{"name":"25279","refsource":"BID","url":"http://www.securityfocus.com/bid/25279"},{"name":"26426","refsource":"SECUNIA","url":"http://secunia.com/advisories/26426"},{"name":"36399","refsource":"OSVDB","url":"http://osvdb.org/36399"},{"name":"1018551","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1018551"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-4336","datePublished":"2007-08-14T18:00:00.000Z","dateReserved":"2007-08-14T00:00:00.000Z","dateUpdated":"2024-08-07T14:53:54.861Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-08-14 18:17:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:directx_media:6.0:*:*:*:*:*:*:*","matchCriteriaId":"CC36A9CA-FB6B-422B-A246-F0A6A8820656"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"4336","Ordinal":"1","Title":"CVE-2007-4336","CVE":"CVE-2007-4336","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"4336","Ordinal":"1","NoteData":"Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value.","Type":"Description","Title":"CVE-2007-4336"},{"CveYear":"2007","CveId":"4336","Ordinal":"2","NoteData":"2007-08-14","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"4336","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}