CVE-2009-0231

Опубликовано: 15 июл. 2009

Источник: nvd

CVSS3: 8.8

CVSS2: 9.3

EPSS Средний

Описание

The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow, aka "Embedded OpenType Font Heap Overflow Vulnerability."

Ссылки

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=811
Broken Link
http://osvdb.org/55842
Broken Link
http://www.securitytracker.com/id?1022543
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-195A.html
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2009/1887
Broken Link
Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-029
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5457
Broken Link
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=811
Broken Link
http://osvdb.org/55842
Broken Link
http://www.securitytracker.com/id?1022543
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-195A.html
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2009/1887
Broken Link
Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-029
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5457
Broken Link

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_2000:-:sp4:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:professional:*:x64:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.64984

Средний

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-681

Связанные уязвимости

GHSA-56xw-8wf9-j3x9