Microsoft Outlook Express vulnerabilities

45 CVEs affecting Microsoft Outlook Express, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2010-3147, published 2010-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2005-1213, published 2005-06-14. High severity, CVSS 7.5. EPSS: 74% chance of exploitation in the next 30 days. Stack-based buffer overflow in the news reader for Microsoft Outlook Express (MSOE.DLL) 5.5 SP2, 6, and 6 SP1 allows remote malicious NNTP servers to execute arbitrary code via a LIST response with a…
CVE-2004-0380, published 2004-05-04. High severity, CVSS 10.0. EPSS: 63.3% chance of exploitation in the next 30 days. The MHTML protocol handler in Microsoft Outlook Express 5.5 SP2 through Outlook Express 6 SP1 allows remote attackers to bypass domain restrictions and execute arbitrary code, as demonstrated on…
CVE-2007-3897, published 2007-10-09. High severity, CVSS 9.3. EPSS: 54.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Protocol (NNTP) servers to execute arbitrary code via long NNTP…
CVE-2006-2111, published 2006-05-01. Medium severity, CVSS 4.3. EPSS: 40.3% chance of exploitation in the next 30 days. A component in Microsoft Outlook Express 6 allows remote attackers to bypass domain restrictions and obtain sensitive information via redirections with the mhtml: URI handler, as originally reported…
CVE-2000-0567, published 2000-07-18. Medium severity, CVSS 5.0. EPSS: 32.3% chance of exploitation in the next 30 days. Buffer overflow in Microsoft Outlook and Outlook Express allows remote attackers to execute arbitrary commands via a long Date field in an email header, aka the "Malformed E-mail Header"…
CVE-2006-2386, published 2006-12-13. Medium severity, CVSS 6.8. EPSS: 28.9% chance of exploitation in the next 30 days. Unspecified vulnerability in Microsoft Outlook Express 6 and earlier allows remote attackers to execute arbitrary code via a crafted contact record in a Windows Address Book (WAB) file.
CVE-2001-1325, published 2001-04-20. High severity, CVSS 7.5. EPSS: 27.3% chance of exploitation in the next 30 days. Internet Explorer 5.0 and 5.5, and Outlook Express 5.0 and 5.5, allow remote attackers to execute scripts when Active Scripting is disabled by including the scripts in XML stylesheets (XSL) that are…
CVE-2000-0653, published 2000-07-20. Medium severity, CVSS 5.0. EPSS: 26.9% chance of exploitation in the next 30 days. Microsoft Outlook Express allows remote attackers to monitor a user's email by creating a persistent browser link to the Outlook Express windows, aka the "Persistent Mail-Browser Link" vulnerability.
CVE-2008-1448, published 2008-08-13. High severity, CVSS 7.1. EPSS: 26.6% chance of exploitation in the next 30 days. The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the correct Internet Explorer Security Zone to UNC share pathnames,…
CVE-2004-2137, published 2004-12-31. Medium severity, CVSS 5.0. EPSS: 26.1% chance of exploitation in the next 30 days. Outlook Express 6.0, when sending multipart e-mail messages using the "Break apart messages larger than" setting, leaks the BCC recipients of the message to the addresses listed in the To and CC…

Latest

CVE-2010-3147, published 2010-08-27. High severity, CVSS 9.3. EPSS: 18.7% chance of exploitation in the next 30 days. Untrusted search path vulnerability in wab.exe 6.00.2900.5512 in Windows Address Book in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008…
CVE-2010-0816, published 2010-05-12. High severity, CVSS 9.3. EPSS: 20.3% chance of exploitation in the next 30 days. Integer overflow in inetcomm.dll in Microsoft Outlook Express 5.5 SP2, 6, and 6 SP1; Windows Live Mail on Windows XP SP2 and SP3, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and…
CVE-2008-5424, published 2008-12-11. Medium severity, CVSS 4.3. EPSS: 12.3% chance of exploitation in the next 30 days. The MimeOleClearDirtyTree function in InetComm.dll in Microsoft Outlook Express 6.00.2900.5512 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2)…
CVE-2007-4040, published 2007-07-27. High severity, CVSS 8.8. EPSS: 13.5% chance of exploitation in the next 30 days. Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute…
CVE-2007-2227, published 2007-06-12. Medium severity, CVSS 4.3. EPSS: 25% chance of exploitation in the next 30 days. The MHTML protocol handler in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle Content-Disposition "notifications," which allows remote attackers to obtain…
CVE-2007-2225, published 2007-06-12. Medium severity, CVSS 4.3. EPSS: 25% chance of exploitation in the next 30 days. A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain…