CVE-2007-6017 json
The PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for…
published 2008-02-29 18 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5987
- cvss
- 5.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
The PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, exposes the unsafe Save method, which allows remote attackers to cause a denial of service (browser crash), or create or overwrite arbitrary files, via string values of the (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, and (19) _MonthText11 properties. NOTE: the vendor states "Authenticated user involvement required," but authentication is not needed to attack a client machine that loads this control.
Exploit prediction
3.06% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
secunia.com
/advisories/27885
third-party-advisory, vendor-advisory
-
secunia.com
/secunia_research/2007-101/
vendor-advisory
- support.veritas.com /docs/300471
-
securitytracker.com
/id?1019525
vdb-entry
- symantec.com /avcenter/security/Content/2008.02.29.html
- seer.entsupport.symantec.com /docs/300471.htm
- seer.support.veritas.com /docs/308669.htm
- symantec.com /avcenter/security/Content/2008.02.28.html
-
vupen.com
/english/advisories/2008/0718
vdb-entry
-
securityfocus.com
/bid/28008
vdb-entry
-
vupen.com
/english/advisories/2008/2672
vdb-entry
Sources
- CVE List CVE-2007-6017
- NVD CVE-2007-6017
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.