CVE-2009-2502

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-2502
Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted TIFF image file, aka "GDI+ TIFF Buffer Overflow Vulnerability."

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.us-cert.gov/cas/techalerts/TA09-286A.html US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5898
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*
cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
OR cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:*
cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:*
cpe:2.3:a:microsoft:report_viewer:2008:sp1:redistributable_package:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp2:itanium:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp2:x64:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp3:itanium:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server:2005:sp3:x64:*:*:*:*:*
cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:xp:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_groove:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:word_viewer:2003:sp3:*:*:*:*:*:*
cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:*
cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:*
cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:*
cpe:2.3:a:microsoft:report_viewer:2008:sp1:redistributable_package:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio:2008:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_.net:2005:sp1:*:*:*:*:*:*

Configuration 6 (hide)

AND
OR cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_2000:*:sp4:*:*:*:*:*:*
History

21 Oct 2024, 17:35

Type Values Removed Values Added
CWE CWE-120
CVSS v2 : 9.3
v3 : unknown 		v2 : 9.3
v3 : 8.1

07 Dec 2023, 18:38

Type Values Removed Values Added
CPE cpe:2.3:o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*
Information

Published : 2009-10-14 10:30

Updated : 2024-10-21 17:35

NVD link : CVE-2009-2502

Mitre link : CVE-2009-2502

CVE.ORG link : CVE-2009-2502

JSON object : View

Products Affected

microsoft

  • visual_studio
  • .net_framework
  • office_groove
  • sql_server
  • windows_vista
  • word_viewer
  • office
  • works
  • visual_studio_.net
  • windows_server_2008
  • office_powerpoint_viewer
  • excel_viewer
  • expression_web
  • office_compatibility_pack
  • windows_2003_server
  • windows_xp
  • internet_explorer
  • forefront_client_security
  • project
  • windows_2000
  • visio
  • sql_server_reporting_services
  • office_excel_viewer
  • platform_sdk
  • office_word_viewer
  • report_viewer
  • visual_foxpro
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')