Buffer overflow

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML...

CVE-2009-2493

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly...

Design/Logic Flaw

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly...

Design/Logic Flaw

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantCle...

CVE-2009-2495

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML...

CVE-2009-2495

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML...

CVE-2009-2495

CVE-2009-2495 is part of the ATL mathing family addressed by Microsoft in MS09-035/MS09-060. The vulnerability is the ATL Null String Vulnerability, where an attacker could read memory beyond the end of a string due to improper termination in ATL-based components/controls built with Visual Studio...

CVE-2009-0901

CVE-2009-0901 describes a remote code execution vulnerability in Microsoft Active Template Library (ATL) used by Visual Studio and Windows components. The issue arises when ATL headers mishandle uninitialized VARIANTs, allowing a specially crafted stream to trigger VariantClear on an uninitialize...

CVE-2009-0901

The Active Template Library ATL in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantCle...

Microsoft Security Bulletin MS09-035 - Moderate Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)

Microsoft Security Bulletin MS09-035 - Moderate Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution 969706 Published: July 28, 2009 Version: 1.0 General Information Executive Summary This security update addresses several privately reported vulnerabilities i...

Microsoft Visual Studio ATL 'VariantClear()'远程代码执行漏洞

Bugraq ID: 35832 CVE ID：CVE-2009-0901 CNCVE ID：CNCVE-20090901 Microsoft Visual Studio是一款微软公司的开发工具套件系列产品。 Microsoft活动模版库ATL处理ATL头字段存在问题，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 ATL头字段存在的一个错误允许攻击者对未正确初始化的VARIANT进行VariantClear调用，基于此攻击者可以提供破坏的流触发错误处理过程中来调用VariantClear而控制整个流程。此漏洞只影响安装了使用Visual Studio...

PT-2009-4900

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio .NET versions 2003 SP1 through 2008 SP1 Microsoft Visual C++ versions 2005 SP1 through 2008 SP1 Windows versions prior to Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold...

Microsoft Visual Studio ATL COM对象远程代码执行漏洞

Bugraq ID: 35828 CVE ID：CVE-2009-2493 Microsoft Visual Studio是一款微软公司的开发工具套件系列产品。 Microsoft活动模版库ATL处理数据流对象实例化时ATL头存在错误，远程攻击者可以利用漏洞绕过IE等Kill-bits安全策略，并导致任意代码执行。 此漏洞只影响安装了使用Visual Studio ATL的组件和控件的系统。如果组件或控件使用ATL，不安全使用OleLoadFromStream允许任意对象实例化，可绕过相关的安全策略，如 Internet Explorer的Kill...

PT-2009-4902

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio .NET versions 2003 SP1 through 2008 SP1 Visual C++ versions 2005 SP1 through 2008 SP1 Description The issue is related to the Active Template Library ATL in Microsoft Visual Studio, which does not properly enforce strin...

Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability

Description Microsoft Visual Studio is prone to a remote code-execution vulnerability in the Active Template Library ATL. Remote attackers can exploit this issue to execute arbitrary code with the privileges of the user running an application built with the affected library. Technologies Affected...

Microsoft Visual Studio和Internet Explorer未明远程代码执行漏洞

Bugraq ID: 35804 CNCAN ID：CNCAN-2009072803 Microsoft Visual Studio是一款微软公司的开发工具套件系列产品。 Microsoft Internet Explorer是一款流行的WEB浏览器。 Blackhat会议公布了Microsoft Visual Studio和Internet Explorer的未明安全问题，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 目前没有详细漏洞细节提供。 Microsoft Visual Studio 2008 SP1 Microsoft Visual Studio 2008 0...

Microsoft Visual Studio 'MSCOMM32.OCX' ActiveX Control Heap Buffer Overflow Vulnerability

Description Microsoft Visual Studio is prone to a remote heap-based buffer-overflow vulnerability. Attackers may exploit this issue by enticing an unsuspecting victim to view a malicious webpage. Successful exploits will allow attackers to execute arbitrary code within the context of the affected...

Microsoft Windows Common AVI ActiveX Control File Parsing Buffer Overflow Vulnerability(MS08-070)

CVE-2008-4255 Microsoft Windows Common AVI ActiveX control is prone to a remote buffer-overflow vulnerability. Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control typically Internet Explorer. Successful exploits will...

Microsoft Windows Common AVI ActiveX Control File Parsing Buffer Overflow Vulnerability

Description Microsoft Windows Common AVI ActiveX control is prone to a remote buffer-overflow vulnerability. Remote attackers can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control typically Internet Explorer. Successful exploits will compromi...

Microsoft Visual Studio MaskedEdit ActiveX Control Buffer Overflow (MS08-070; CVE-2008-3704)

Microsoft Visual Studio is designed for building Windows based applications and Web solutions. A buffer overflow vulnerability has been reported in Microsoft Visual Studio. The vulnerability is due to a memory corruption error in the Visual Basic MaskedEdit ActiveX control when it fails to proper...