CVE-2003-1378

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary programs via an HTML email with the CODEBASE parameter set to the program, a vulnerability similar to CAN-2002-0077.

Metrics

CVSS 2.0 8.8/10AV:N/AC:M/Au:N/C:C/I:C/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2003
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2003

CVE-2003-13795.0clarkconnectd in ClarkConnect Linux 1.2 allows remote attackers to obtain sensitive information about the server via the characters (1) A, wCVE-2003-13807.5Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to (1) list directories above the root via an 'ls @CVE-2003-13816.8Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arbCVE-2003-13827.5Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) RCVE-2003-13837.5WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which conCVE-2003-13844.3Cross-site scripting (XSS) vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via CVE-2003-13856.8ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register_globals is enabled, by modifyingCVE-2003-13866.4AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, wCVE-2003-13877.5Buffer overflow in Opera 6.05 and 6.06, and possibly other versions, allows remote attackers to execute arbitrary code via a URL with a longCVE-2003-13889.3Buffer overflow in Opera 7.02 Build 2668 allows remote attackers to crash Opera via a long HTTP request ending in a .ZIP extension.CVE-2003-13897.5RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute forceCVE-2003-13907.5RTS CryptoBuddy 1.2 and earlier stores bytes 53 through 55 of a 55-byte passphrase in plaintext, which makes it easier for local users to gu
CVE-2003-1378: High severity, CVSS 8.8 | Vulnix