{"api_version":"1","generated_at":"2026-07-23T08:47:44+00:00","cve":"CVE-2007-6016","urls":{"html":"https://cve.report/CVE-2007-6016","api":"https://cve.report/api/cve/CVE-2007-6016.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-6016","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-6016"},"summary":{"title":"CVE-2007-6016","description":"Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states \"Authenticated user involvement required,\" but authentication is not needed to attack a client machine that loads this control.","state":"PUBLISHED","assigner":"flexera","published_at":"2008-02-29 19:44:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.securityfocus.com/bid/26904","name":"http://www.securityfocus.com/bid/26904","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Symantec Backup Exec Scheduler ActiveX Control Multiple Stack Based Buffer Overflow Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2008/0718","name":"http://www.vupen.com/english/advisories/2008/0718","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/secunia_research/2007-101/advisory/","name":"http://secunia.com/secunia_research/2007-101/advisory/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Symantec Backup Exec Calendar Control Multiple Vulnerabilities - Secunia Research - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/5205","name":"https://www.exploit-db.com/exploits/5205","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Symantec BackupExec Calendar Control - 'PVCalendar.ocx' Remote Buffer Overflow - Windows remote Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2672","name":"http://www.vupen.com/english/advisories/2008/2672","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.symantec.com/avcenter/security/Content/2008.02.28.html","name":"http://www.symantec.com/avcenter/security/Content/2008.02.28.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://seer.support.veritas.com/docs/308669.htm","name":"http://seer.support.veritas.com/docs/308669.htm","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Veritas | The Leader in Enterprise Data Protection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.symantec.com/avcenter/security/Content/2008.02.29.html","name":"http://www.symantec.com/avcenter/security/Content/2008.02.29.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"404 Not Found","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://securitytracker.com/id?1019524","name":"http://securitytracker.com/id?1019524","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Symantec Backup Exec for Windows Server ActiveX Control Buffer Overflow Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/27885","name":"http://secunia.com/advisories/27885","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Symantec Backup Exec Calendar Control Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-6016","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-6016","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"6016","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"backup_exec_for_windows_server","cpe6":"11d","cpe7":"11.0.6235","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"6016","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"backup_exec_for_windows_server","cpe6":"11d","cpe7":"11.0.7170","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"6016","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"symantec","cpe5":"backup_exec_for_windows_server","cpe6":"12.0","cpe7":"12.0.1364","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T15:54:25.646Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"26904","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/26904"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.symantec.com/avcenter/security/Content/2008.02.29.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://seer.support.veritas.com/docs/308669.htm"},{"name":"1019524","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1019524"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.symantec.com/avcenter/security/Content/2008.02.28.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://secunia.com/secunia_research/2007-101/advisory/"},{"name":"ADV-2008-0718","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0718"},{"name":"27885","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/27885"},{"name":"5205","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/5205"},{"name":"ADV-2008-2672","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2672"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-02-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states \"Authenticated user involvement required,\" but authentication is not needed to attack a client machine that loads this control."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"44d08088-2bea-4760-83a6-1e9be26b15ab","shortName":"flexera"},"references":[{"name":"26904","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/26904"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.symantec.com/avcenter/security/Content/2008.02.29.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://seer.support.veritas.com/docs/308669.htm"},{"name":"1019524","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1019524"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.symantec.com/avcenter/security/Content/2008.02.28.html"},{"tags":["x_refsource_MISC"],"url":"http://secunia.com/secunia_research/2007-101/advisory/"},{"name":"ADV-2008-0718","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0718"},{"name":"27885","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/27885"},{"name":"5205","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/5205"},{"name":"ADV-2008-2672","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2672"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"PSIRT-CNA@flexerasoftware.com","ID":"CVE-2007-6016","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states \"Authenticated user involvement required,\" but authentication is not needed to attack a client machine that loads this control."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"26904","refsource":"BID","url":"http://www.securityfocus.com/bid/26904"},{"name":"http://www.symantec.com/avcenter/security/Content/2008.02.29.html","refsource":"CONFIRM","url":"http://www.symantec.com/avcenter/security/Content/2008.02.29.html"},{"name":"http://seer.support.veritas.com/docs/308669.htm","refsource":"CONFIRM","url":"http://seer.support.veritas.com/docs/308669.htm"},{"name":"1019524","refsource":"SECTRACK","url":"http://securitytracker.com/id?1019524"},{"name":"http://www.symantec.com/avcenter/security/Content/2008.02.28.html","refsource":"CONFIRM","url":"http://www.symantec.com/avcenter/security/Content/2008.02.28.html"},{"name":"http://secunia.com/secunia_research/2007-101/advisory/","refsource":"MISC","url":"http://secunia.com/secunia_research/2007-101/advisory/"},{"name":"ADV-2008-0718","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0718"},{"name":"27885","refsource":"SECUNIA","url":"http://secunia.com/advisories/27885"},{"name":"5205","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/5205"},{"name":"ADV-2008-2672","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2672"}]}}}},"cveMetadata":{"assignerOrgId":"44d08088-2bea-4760-83a6-1e9be26b15ab","assignerShortName":"flexera","cveId":"CVE-2007-6016","datePublished":"2008-02-29T19:00:00.000Z","dateReserved":"2007-11-19T00:00:00.000Z","dateUpdated":"2024-08-07T15:54:25.646Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-02-29 19:44:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:backup_exec_for_windows_server:11d:11.0.6235:*:*:*:*:*:*","matchCriteriaId":"7BB204AD-5637-4408-858E-DBEB2EDAB292"},{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:backup_exec_for_windows_server:11d:11.0.7170:*:*:*:*:*:*","matchCriteriaId":"90137D90-F420-45C7-9662-802D7EF61A89"},{"vulnerable":true,"criteria":"cpe:2.3:a:symantec:backup_exec_for_windows_server:12.0:12.0.1364:*:*:*:*:*:*","matchCriteriaId":"1CBEACF9-E444-4433-8587-09FE25CAF79E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"6016","Ordinal":"1","Title":"CVE-2007-6016","CVE":"CVE-2007-6016","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"6016","Ordinal":"1","NoteData":"Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states \"Authenticated user involvement required,\" but authentication is not needed to attack a client machine that loads this control.","Type":"Description","Title":"CVE-2007-6016"},{"CveYear":"2007","CveId":"6016","Ordinal":"2","NoteData":"2008-02-29","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"6016","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}