CVE-2009-1217

Опубликовано: 01 апр. 2009

Источник: nvd

CVSS2: 4.3

EPSS Средний

Описание

Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka the "Microsoft GdiPlus EMF GpFont.SetData integer overflow."

Ссылки

http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html
Broken Link
http://blogs.technet.com/srd/archive/2009/03/26/new-emf-gdiplus-dll-crash-not-exploitable-for-code-execution.aspx
Broken Link
http://www.securityfocus.com/bid/34250
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/0832
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49438
Third Party Advisory
VDB Entry
http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html
Broken Link
http://blogs.technet.com/srd/archive/2009/03/26/new-emf-gdiplus-dll-crash-not-exploitable-for-code-execution.aspx
Broken Link
http://www.securityfocus.com/bid/34250
Third Party Advisory
VDB Entry
http://www.vupen.com/english/advisories/2009/0832
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/49438
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:microsoft:gdi\+:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.50042

Средний

4.3 Medium

CVSS2

Дефекты

CWE-193

Связанные уязвимости

GHSA-8g6h-gj49-cm84

github

почти 4 года назад