CVE-2007-5661

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

The Macrovision InstallShield InstallScript One-Click Install (OCI) ActiveX control 12.0 before SP2 does not validate the DLL files that are named as parameters to the control, which allows remote attackers to download arbitrary library code onto a client machine.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640Patch
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=649Not Applicable
http://secunia.com/advisories/29549Patch, Vendor Advisory
http://securitytracker.com/id?1019735Not Applicable
http://www.securityfocus.com/bid/28533Patch
http://www.vupen.com/english/advisories/2008/1049Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/41558Third Party Advisory
http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640Patch
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=649Not Applicable
http://secunia.com/advisories/29549Patch, Vendor Advisory
http://securitytracker.com/id?1019735Not Applicable
http://www.securityfocus.com/bid/28533Patch
http://www.vupen.com/english/advisories/2008/1049Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/41558Third Party Advisory

Timeline

Published: Apr 4, 2008
Last modified: Jun 16, 2026
NVD status: Analyzed

Related CVEs from 2007

CVE-2007-56639.3Adobe Reader and Acrobat 8.1.1 and earlier allows remote attackers to execute arbitrary code via a crafted PDF file that calls an insecure J CVE-2007-56646.9db2dasrrm in the DB2 Administration Server (DAS) in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before F CVE-2007-56657.2STEngine.exe 3.5.0.20 in Novell ZENworks Endpoint Security Management (ESM) 3.5, and other ESM versions before 3.5.0.82, dynamically creates CVE-2007-56666.2Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicio CVE-2007-56677.2NWFILTER.SYS in Novell Client 4.91 SP 1 through SP 4 for Windows 2000, XP, and Server 2003 makes the \.\nwfilter device available for arbitr CVE-2007-56714.4HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE CVE-2007-56734.3Cross-site scripting (XSS) vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML CVE-2007-56746.8Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic_quotes_gpc is disabled, allows re CVE-2007-56757.5Stack-based buffer overflow in the DebugPrint function in MultiXTpm Application Server before 4.0.2d allows remote attackers to execute arbi CVE-2007-56766.8PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbi CVE-2007-56774.3Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject arbitrary web script o CVE-2007-56787.5SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter i