deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3657
Published: 2009-10-09
Description: Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://drupal.org/node/592488; http://www.securityfocus.com/bid/36563; https://exchange.xforce.ibmcloud.com/vulnerabilities/53560
CVE: CVE-2009-3658
Published: 2009-10-09
Description: Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trigger memory corruption or possibly execute arbitrary code via a malformed argument to the SetSuperBuddy method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://retrogod.altervista.org/9sg_aol_91_superbuddy.html; http://secunia.com/advisories/36919; http://www.securityfocus.com/archive/1/506889/100/0/threaded
CVE: CVE-2009-3659
Published: 2009-10-11
Description: SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9669; https://exchange.xforce.ibmcloud.com/vulnerabilities/53236; http://www.exploit-db.com/exploits/9669
CVE: CVE-2009-3660
Published: 2009-10-11
Description: PHP remote file inclusion vulnerability in libraries/database.php in Efront 3.5.4 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.  NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's security documentation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://forum.efrontlearning.net/viewtopic.php?f=1&t=1354&p=7174#p7174; http://www.exploit-db.com/exploits/9681; http://www.securityfocus.com/bid/36411
CVE: CVE-2009-3661
Published: 2009-10-11
Description: Multiple SQL injection vulnerabilities in the DJ-Catalog (com_djcatalog) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a showItem action and (2) cid parameter in a show action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/36696; http://www.design-joomla.eu/joomla-news/dj-catalog-sql-bsql-injection-multiple-vulnerability-fix.html; http://www.exploit-db.com/exploits/9693
CVE: CVE-2009-3662
Published: 2009-10-11
Description: FileCopa FTP Server 5.01 allows remote attackers to cause a denial of service (server hang) via a large number of crafted NOOP commands.
CVSS Score: 5.0 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/36397.txt; http://secunia.com/advisories/36773; http://www.securityfocus.com/bid/36397
CVE: CVE-2009-3663
Published: 2009-10-11
Description: Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the Host header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://httpdx.sourceforge.net/downloads/changelog.log; http://osvdb.org/58129; http://secunia.com/advisories/36734
CVE: CVE-2009-3664
Published: 2009-10-11
Description: Multiple directory traversal vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to include or execute arbitrary files via a .. (dot dot) in the (1) p and (2) s parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/36648; http://www.exploit-db.com/exploits/9625; http://www.osvdb.org/57919
CVE: CVE-2009-3665
Published: 2009-10-11
Description: Multiple SQL injection vulnerabilities in index.php in Nullam Blog 0.1.2 allow remote attackers to execute arbitrary SQL commands via the (1) i parameter or (2) v parameters in a register action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36648; http://www.exploit-db.com/exploits/9625; http://www.osvdb.org/57920
CVE: CVE-2009-3666
Published: 2009-10-11
Description: Cross-site scripting (XSS) vulnerability in index.php in Nullam Blog 0.1.2 allows remote attackers to inject arbitrary web script or HTML via the e parameter in an error action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/36648; http://www.exploit-db.com/exploits/9625; http://www.osvdb.org/57921
CVE: CVE-2009-3667
Published: 2009-10-11
Description: SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows remote attackers to execute arbitrary SQL commands via the Username.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9696; http://www.exploit-db.com/exploits/9696
CVE: CVE-2009-3668
Published: 2009-10-11
Description: Cross-site scripting (XSS) vulnerability in ardguest.php in Ardguest 1.8 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0909-exploits/ardguest-xss.txt; http://secunia.com/advisories/36630; http://packetstormsecurity.org/0909-exploits/ardguest-xss.txt
CVE: CVE-2009-3669
Published: 2009-10-11
Description: SQL injection vulnerability in the foobla Suggestions (com_foobla_suggestions) component 1.5.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the idea_id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9697; http://www.securityfocus.com/bid/36425; http://www.exploit-db.com/exploits/9697
CVE: CVE-2009-3670
Published: 2009-10-11
Description: Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/57983; http://secunia.com/advisories/36621; http://www.exploit-db.com/exploits/9624
CVE: CVE-2009-2684
Published: 2009-10-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=148; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5823&w=2; http://secunia.com/advisories/36969
CVE: CVE-2009-2699
Published: 2009-10-13
Description: The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9819&w=2; http://securitytracker.com/id?1022988; http://www.apache.org/dist/httpd/CHANGES_2.2.14
CVE: CVE-2009-2897
Published: 2009-10-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS; http://forums.hyperic.com/jiveforums/thread.jspa?messageID=22156&#22156; http://jira.hyperic.com/browse/HHQ-2655
CVE: CVE-2009-2898
Published: 2009-10-13
Description: Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=advisory&name=Hyperic_HQ_Multiple_XSS; http://jira.hyperic.com/browse/HHQ-3390; http://secunia.com/advisories/36935
CVE: CVE-2009-2908
Published: 2009-10-13
Description: The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount.
CVSS Score: 4.9 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git%3Ba=commit%3Bh=afc2b6932f48f200736d3e36ad66fee0ec733136; http://lists.vmware.com/pipermail/security-announce/2010/000082.html; http://secunia.com/advisories/37075
CVE: CVE-2009-3459
Published: 2009-10-13
Description: Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html; http://isc.sans.org/diary.html?storyid=7300; http://secunia.com/advisories/36983
CVE: CVE-2009-3587
Published: 2009-10-13
Description: Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption, a different vulnerability than CVE-2009-3588.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/58691; http://secunia.com/advisories/36976; http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878
CVE: CVE-2009-3588
Published: 2009-10-13
Description: Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3587.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/36976; http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=218878; http://www.securityfocus.com/archive/1/507068/100/0/threaded
CVE: CVE-2009-3602
Published: 2009-10-13
Description: Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://osvdb.org/58836; http://secunia.com/advisories/36996; http://secunia.com/advisories/37913
CVE: CVE-2009-3691
Published: 2009-10-13
Description: Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and (3) ServerSize, field that triggers a stack-based buffer overflow involving a crafted HostList field.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://retrogod.altervista.org/9sg_ibm_setnet32.html; http://secunia.com/advisories/36949; http://securitytracker.com/id?1022985
CVE: CVE-2009-3692
Published: 2009-10-13
Description: Unspecified vulnerability in the VBoxNetAdpCtl configuration tool in Sun VirtualBox 3.0.x before 3.0.8 on Solaris x86, Linux, and Mac OS X allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://secunia.com/advisories/36929; http://securitytracker.com/id?1022990; http://sunsolve.sun.com/search/document.do?assetkey=1-66-268188-1
CVE: CVE-2009-3693
Published: 2009-10-13
Description: Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to create arbitrary files via \.. (backwards slash dot dot) sequences in the third argument to the MakeHttpRequest method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://retrogod.altervista.org/9sg_hp_loadrunner.html; http://secunia.com/advisories/36898; http://retrogod.altervista.org/9sg_hp_loadrunner.html
CVE: CVE-2009-3694
Published: 2009-10-13
Description: Directory traversal vulnerability in config/config.php in ezRecipe-Zee 91, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cfg[prePath] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/58709; http://secunia.com/advisories/36992; http://securityreason.com/expldownload/1/7380/1
CVE: CVE-2009-3695
Published: 2009-10-13
Description: Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457; http://groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51/; http://secunia.com/advisories/36948
CVE: CVE-2009-0090
Published: 2009-10-14
Description: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtain unintended access to stack memory, and execute arbitrary code, via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Pointer Verification Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5716
CVE: CVE-2009-0091
Published: 2009-10-14
Description: Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "Microsoft .NET Framework Type Verification Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6451
CVE: CVE-2009-0555
Published: 2009-10-14
Description: Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACM), does not properly process Advanced Systems Format (ASF) files, which allows remote attackers to execute arbitrary code via a crafted audio file that uses the Windows Media Speech codec, aka "Windows Media Runtime Voice Sample Rate Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-051; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6407
CVE: CVE-2009-1547
Published: 2009-10-14
Description: Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted data stream header that triggers memory corruption, aka "Data Stream Header Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-054; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6454
CVE: CVE-2009-2497
Published: 2009-10-14
Description: The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly handle interfaces, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted Silverlight application, (3) a crafted ASP.NET application, or (4) a crafted .NET Framework application, aka "Microsoft Silverlight and Microsoft .NET Framework CLR Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-061; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6510
CVE: CVE-2009-2500
Published: 2009-10-14
Description: Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted WMF image file, aka "GDI+ WMF Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5967
CVE: CVE-2009-2501
Published: 2009-10-14
Description: Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file, aka "GDI+ PNG Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5800
CVE: CVE-2009-2502
Published: 2009-10-14
Description: Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted TIFF image file, aka "GDI+ TIFF Buffer Overflow Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-119, CWE-120
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5898
CVE: CVE-2009-2503
Published: 2009-10-14
Description: GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 does not properly allocate an unspecified buffer, which allows remote attackers to execute arbitrary code via a crafted TIFF image file that triggers memory corruption, aka "GDI+ TIFF Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6491
CVE: CVE-2009-2504
Published: 2009-10-14
Description: Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server 2008 Gold, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allow remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "GDI+ .NET API Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-286A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6282