CVE-2007-5661

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-04-04 · updated 2026-06-16
Weakness: CWE-94

Description

The Macrovision InstallShield InstallScript One-Click Install (OCI) ActiveX control 12.0 before SP2 does not validate the DLL files that are named as parameters to the control, which allows remote attackers to download arbitrary library code onto a client machine.

Affected products

Revenera Installshield: before 12; 12, 12-sp1 — fixed in 12

How to fix

Upgrade to a fixed version: Revenera Installshield 12. Check the vendor advisory for mitigations.

References

http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=649
http://secunia.com/advisories/29549
http://securitytracker.com/id?1019735
http://www.securityfocus.com/bid/28533
http://www.vupen.com/english/advisories/2008/1049
https://exchange.xforce.ibmcloud.com/vulnerabilities/41558
http://knowledge.macrovision.com/selfservice/microsites/search.do?cmd=displayKC&externalId=Q113640
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=649
http://secunia.com/advisories/29549
http://securitytracker.com/id?1019735
http://www.securityfocus.com/bid/28533

Get alerted when CVE-2007-5661 or the next vulnerability affects your stack