CVE Feed

    Dashboard / CVE / CVE-2008-3068

    CVE-2008-3068

    Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.

    Published:Jul 7, 2008
    Last Modified:Apr 23, 2026
    EPS:Jul 7, 2008
    EPSS Score:0.12634
    CVSS Score:7.5

    Affected Products

    Vendor
    Microsoft
    Product
    Access
    Vendor
    Microsoft
    Product
    Excel
    Vendor
    Microsoft
    Product
    Frontpage
    Vendor
    Microsoft
    Product
    Groove
    Vendor
    Microsoft
    Product
    Infopath
    Vendor
    Microsoft
    Product
    Office
    Vendor
    Microsoft
    Product
    Office Communicator
    Vendor
    Microsoft
    Product
    Onenote
    Vendor
    Microsoft
    Product
    Outlook
    Vendor
    Microsoft
    Product
    Powerpoint
    Vendor
    Microsoft
    Product
    Project Professional
    Vendor
    Microsoft
    Product
    Project Standard
    Vendor
    Microsoft
    Product
    Publisher
    Vendor
    Microsoft
    Product
    Sharepoint Designer
    Vendor
    Microsoft
    Product
    Visio Professional
    Vendor
    Microsoft
    Product
    Visio Standard
    Vendor
    Microsoft
    Product
    Windows Live Mail

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-69477 (CVSS 7.3) — Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally.…
    CVE-2026-69614 (CVSS 8.8) — Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a …
    CVE-2026-69778 (CVSS 8.8) — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a n…
    CVE-2026-69529 (CVSS 8.8) — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a n…
    CVE-2026-64919 (CVSS 7.8) — Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally…
    CVE-2026-64920 (CVSS 7.8) — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.…
    CVE-2026-64914 (CVSS 7.8) — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.…
    CVE-2026-64908 (CVSS 7.8) — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.…
    CVE-2026-64912 (CVSS 7.8) — Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally…
    CVE-2026-64906 (CVSS 7.8) — Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.…

    References

    http://securityreason.com/securityalert/3978
    http://www.securityfocus.com/archive/1/493947/100/0/threaded
    http://www.securityfocus.com/archive/1/494101/100/0/threaded
    http://www.securityfocus.com/bid/28548
    http://www.securitytracker.com/id?1019736
    http://www.securitytracker.com/id?1019737
    http://www.securitytracker.com/id?1019738
    https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
    https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
    https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
    https://www.cynops.de/techzone/http_over_x509.html
    https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
    https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
    https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt
    http://securityreason.com/securityalert/3978
    http://www.securityfocus.com/archive/1/493947/100/0/threaded
    http://www.securityfocus.com/archive/1/494101/100/0/threaded
    http://www.securityfocus.com/bid/28548
    http://www.securitytracker.com/id?1019736
    http://www.securitytracker.com/id?1019737
    http://www.securitytracker.com/id?1019738
    https://www.cynops.de/advisories/AKLINK-SA-2008-002.txt
    https://www.cynops.de/advisories/AKLINK-SA-2008-003.txt
    https://www.cynops.de/advisories/AKLINK-SA-2008-004.txt
    https://www.cynops.de/techzone/http_over_x509.html
    https://www.klink.name/security/aklink-sa-2008-002-outlook-smime.txt
    https://www.klink.name/security/aklink-sa-2008-003-live-mail-smime.txt
    https://www.klink.name/security/aklink-sa-2008-004-office2007-signatures.txt

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High