CVE-2009-2528

GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "Memory Corruption Vulnerability."

Score

CVSS 2.0 9.3 Critical

Status

Modified - secure@microsoft.com

Published

2009-10-14

Last modified

2024-08-07

Weaknesses

CWE-94

Affected products

• .net Framework (Microsoft)
• Excel Viewer (Microsoft)
• Expression Web (Microsoft)
• Forefront Client Security (Microsoft)
• Internet Explorer (Microsoft)
• Office (Microsoft)
• Office Compatibility Pack (Microsoft)
• Office Excel Viewer (Microsoft)
• Office Groove (Microsoft)
• Office Powerpoint Viewer (Microsoft)
• Office Word Viewer (Microsoft)
• Platform Sdk (Microsoft)
• Project (Microsoft)
• Report Viewer (Microsoft)
• Sql Server (Microsoft)
• Sql Server Reporting Services (Microsoft)
• Visio (Microsoft)
• Visual Foxpro (Microsoft)
• Visual Studio (Microsoft)
• Visual Studio .net (Microsoft)
• Windows 2003 Server (Microsoft)
• Windows Server 2008 (Microsoft)
• Windows Vista (Microsoft)
• Windows Xp (Microsoft)
• Word Viewer (Microsoft)
• Works (Microsoft)

References

• http://www.us-cert.gov/cas/techalerts/TA09-286A.html
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6426