CVE-2007-2216

The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation, which allows remote attackers to execute arbitrary code by requesting the HelpString property, involving a crafted DLL file argument to the TypeLibInfoFromFile function, which overwrites the HelpStringDll property to call the DLLGetDocumentation function in another DLL file, aka "ActiveX Object Vulnerability."

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

41.39% chance of exploitation in the next 30 days, 99th percentile

Published

2007-08-14

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/30490

References

• CVE Record
• NVD entry

Related

• CVE-2007-2212
• CVE-2007-2217
• CVE-2007-2211
• CVE-2007-2221
• CVE-2007-2210
• CVE-2007-2222