CVE-2007-6017

CVE-2007-6017 describes an unsafe Save method in the PVATLCalendar.PVCalendar.1 ActiveX control (pvcalendar.ocx) within Symantec Backup Exec for Windows Server (BEWS) versions 11d and 12.0. This vulnerability allows remote attackers to cause a denial of service (browser crash) or create/overwrite arbitrary files by manipulating specific string properties. The vulnerability has a CVSS score of 5.1, indicating a medium severity. It can be exploited remotely over the network (AV:N) with high attack complexity (AC:H) and requires no authentication (Au:N), leading to potential partial confidentiality, integrity, and availability impacts (C:P/I:P/A:P). Despite its age, there is no evidence of active exploitation, publicly available exploit code in Metasploit or ExploitDB, or significant community discussion or media coverage. Its EPSS score is low, suggesting a minimal likelihood of exploitation.