CVE-2009-2528

2009-10-1410:30:00

CWE-94

[email protected]

web.nvd.nist.gov

109

cve-2009-2528

gdi+

microsoft office

sp3

memory corruption

vulnerability

nvd

7.2 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.82 High

EPSS

Percentile

98.4%

JSON

GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka “Memory Corruption Vulnerability.”

CPENameOperatorVersion
microsoft:windows_2003_servermicrosoft windows 2003 servereq*
microsoft:windows_xpmicrosoft windows xpeq*
microsoft:windows_vistamicrosoft windows vistaeq*
microsoft:windows_server_2008microsoft windows server 2008eq*
microsoft:.net_frameworkmicrosoft .net frameworkeq1.1
microsoft:.net_frameworkmicrosoft .net frameworkeq2.0
microsoft:internet_explorermicrosoft internet explorereq6
microsoft:report_viewermicrosoft report viewereq2008
microsoft:sql_server_reporting_servicesmicrosoft sql server reporting serviceseq2000
microsoft:sql_servermicrosoft sql servereq2005

CPE	Name	Operator	Version
microsoft:windows_2003_server	microsoft windows 2003 server	eq	*
microsoft:windows_xp	microsoft windows xp	eq	*
microsoft:windows_vista	microsoft windows vista	eq	*
microsoft:windows_server_2008	microsoft windows server 2008	eq	*
microsoft:.net_framework	microsoft .net framework	eq	1.1
microsoft:.net_framework	microsoft .net framework	eq	2.0
microsoft:internet_explorer	microsoft internet explorer	eq	6
microsoft:report_viewer	microsoft report viewer	eq	2008
microsoft:sql_server_reporting_services	microsoft sql server reporting services	eq	2000
microsoft:sql_server	microsoft sql server	eq	2005