What’s Vulnerable › Vulnerabilities

CVE-2007-6387

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 38.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2007-12-15 · updated 2026-06-16
• Weakness: CWE-119

Description

Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics AnswerWorks, and Intuit Clearly Bookkeeping, ProSeries, QuickBooks, Quicken, QuickTax, and TurboTax, allow remote attackers to execute arbitrary code via long arguments to the (1) GetHistory, (2) GetSeedQuery, (3) SetSeedQuery, and possibly other methods. NOTE: some of these details are obtained from third party information.

Affected products

• Intuit Bookkeeping: all versions
• Intuit Proseries: all versions
• Intuit Quickbooks: all versions
• Intuit Quicken: all versions
• Intuit Quicktax: all versions
• Intuit Turbo Tax: all versions
• Microsoft Activex: 4.0.0.42
• Vantage Linquistics Answerworks: all versions

References

• http://secunia.com/advisories/26566
• http://secunia.com/advisories/26670
• http://support.quickbooks.intuit.com/support/qbupdate2007/Default.aspx
• http://www.intuit.com/support/security/
• http://www.securityfocus.com/bid/26815
• http://www.vantagelinguistics.com/answerworks/release/
• http://www.vupen.com/english/advisories/2007/4194
• http://www.vupen.com/english/advisories/2007/4195
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39004
• https://www.exploit-db.com/exploits/4825
• http://secunia.com/advisories/26566
• http://secunia.com/advisories/26670

Get alerted when CVE-2007-6387 or the next vulnerability affects your stack