CVE-2009-2500 Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2...
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted WMF image file, aka "GDI+ WMF Integer Overflow Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2003 server | All versions | No fix listed |
| Microsoft windows server 2008 | All versions | No fix listed |
| Microsoft windows vista | All versions | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
| Microsoft net framework | = 1.1-sp1 | No fix listed |
| Microsoft net framework | = 2.0-sp1 | No fix listed |
| Microsoft net framework | = 2.0-sp2 | No fix listed |
| Microsoft internet explorer | = 6-sp1 | No fix listed |
| Microsoft report viewer | = 2005-sp1 | No fix listed |
| Microsoft report viewer | = 2008 | No fix listed |
| Microsoft report viewer | = 2008-sp1 | No fix listed |
| Microsoft sql server | = 2005-sp2 | No fix listed |
| Microsoft sql server | = 2005-sp3 | No fix listed |
| Microsoft sql server reporting services | = 2000-sp2 | No fix listed |
| Microsoft excel viewer | = 2003 | No fix listed |
| Microsoft excel viewer | = 2003-sp3 | No fix listed |
| Microsoft expression web | All versions | No fix listed |
| Microsoft expression web | = 2 | No fix listed |
| Microsoft office | = 2003-sp3 | No fix listed |
| Microsoft office | = 2007-sp1 | No fix listed |
| Microsoft office | = 2007-sp2 | No fix listed |
| Microsoft office | = xp | No fix listed |
| Microsoft office compatibility pack | = 2007-sp1 | No fix listed |
| Microsoft office compatibility pack | = 2007-sp2 | No fix listed |
| Microsoft office excel viewer | All versions | No fix listed |
Show 19 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office groove | = 2007 | No fix listed |
| Microsoft office groove | = 2007-sp1 | No fix listed |
| Microsoft office powerpoint viewer | All versions | No fix listed |
| Microsoft office powerpoint viewer | = 2007-sp1 | No fix listed |
| Microsoft office powerpoint viewer | = 2007-sp2 | No fix listed |
| Microsoft office word viewer | All versions | No fix listed |
| Microsoft project | = 2002-sp1 | No fix listed |
| Microsoft visio | = 2002-sp2 | No fix listed |
| Microsoft word viewer | = 2003 | No fix listed |
| Microsoft word viewer | = 2003-sp3 | No fix listed |
| Microsoft works | = 8.5 | No fix listed |
| Microsoft platform sdk | All versions | No fix listed |
| Microsoft visual studio | = 2008 | No fix listed |
| Microsoft visual studio | = 2008-sp1 | No fix listed |
| Microsoft visual studio .net | = 2003-sp1 | No fix listed |
| Microsoft visual studio .net | = 2005-sp1 | No fix listed |
| Microsoft forefront client security | = 1.0 | No fix listed |
| Microsoft visual foxpro | = 8.0-sp1 | No fix listed |
| Microsoft visual foxpro | = 9.0-sp2 | No fix listed |
References
- TA09-286A third-party-advisory us-government-resource
- MS09-062 vendor-advisory
- oval:org.mitre.oval:def:5967 signature vdb-entry