source: https://www.securityfocus.com/bid/28548/info
Microsoft's Crypto API library is prone to an information-disclosure vulnerability because HTTP requests to arbitrary hosts and ports may be automatically triggered when validating X.509 certificates.
Successful exploits allow attackers to trigger HTTP requests to arbitrary hosts and ports without confirmation or notification to unsuspecting users. Attackers may use this for determining when email and documents are read, for port scanning, or for aiding in other attacks.
The following products are known to exhibit this issue:
Microsoft Outlook 2007
Microsoft Windows Live Mail 2008
Microsoft Office 2007
Other products that use the Crypto API provided by Windows may also be affected.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31583.docx
