CVE-2009-2503
Microsoft Windows GDI+ TIFF Parsing Code Execution Vulnerability
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 does not properly allocate an unspecified buffer, which allows remote attackers to execute arbitrary code via a crafted TIFF image file that triggers memory corruption, aka "GDI+ TIFF Memory Corruption Vulnerability."
GDI+ en Microsoft Internet Explorer v6 SP1, Windows XP SP2 y SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 y SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold y SP3, Office Excel Viewer 2003 Gold y SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, y SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 y SP2, Expression Web, Expression Web v2, Groove 2007 Gold y SP1, Works v8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 y SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold y SP1, y Forefront Client Security v1.0 no localiza adecuadamente un búfer sin especificar, lo que permite a atacantes remotos ejecutar código arbitrario a través de un fichero de imagen TIFF que inicia una corrupción de memoria, también conocido como "Vulnerabilidad de corrupción de memoria GDI+ TIFF"
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required in that a user must open a malicious image file or browse to a malicious website.
The specific flaws exist in the GDI+ subsystem when parsing maliciously crafted TIFF files. By supplying a malformed graphic control extension an attacker can trigger an exploitable memory corruption condition. Successful exploitation can result in arbitrary code execution under the credentials of the currently logged in user.
*Credits:
Ivan Fratric
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-07-17 CVE Reserved
- 2009-10-13 CVE Published
- 2024-08-07 CVE Updated
- 2024-09-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.us-cert.gov/cas/techalerts/TA09-286A.html | Third Party Advisory | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6491 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-062 | 2023-12-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | .net Framework Search vendor "Microsoft" for product ".net Framework" | 1.1 Search vendor "Microsoft" for product ".net Framework" and version "1.1" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | .net Framework Search vendor "Microsoft" for product ".net Framework" | 2.0 Search vendor "Microsoft" for product ".net Framework" and version "2.0" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | .net Framework Search vendor "Microsoft" for product ".net Framework" | 2.0 Search vendor "Microsoft" for product ".net Framework" and version "2.0" | sp2 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | Internet Explorer Search vendor "Microsoft" for product "Internet Explorer" | 6 Search vendor "Microsoft" for product "Internet Explorer" and version "6" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | Forefront Client Security Search vendor "Microsoft" for product "Forefront Client Security" | 1.0 Search vendor "Microsoft" for product "Forefront Client Security" and version "1.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | Visual Foxpro Search vendor "Microsoft" for product "Visual Foxpro" | 8.0 Search vendor "Microsoft" for product "Visual Foxpro" and version "8.0" | sp1 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | Visual Foxpro Search vendor "Microsoft" for product "Visual Foxpro" | 9.0 Search vendor "Microsoft" for product "Visual Foxpro" and version "9.0" | sp2 |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows 2000 Search vendor "Microsoft" for product "Windows 2000" | * | sp4 |
Safe
|
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2, itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 2003 Server Search vendor "Microsoft" for product "Windows 2003 Server" | * | sp2, x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | x32 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Server 2008 Search vendor "Microsoft" for product "Windows Server 2008" | * | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Vista Search vendor "Microsoft" for product "Windows Vista" | * | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | * | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | * | sp2, professional_x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows Xp Search vendor "Microsoft" for product "Windows Xp" | * | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Report Viewer Search vendor "Microsoft" for product "Report Viewer" | 2005 Search vendor "Microsoft" for product "Report Viewer" and version "2005" | sp1, redistributable_package |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Report Viewer Search vendor "Microsoft" for product "Report Viewer" | 2008 Search vendor "Microsoft" for product "Report Viewer" and version "2008" | redistributable_package |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Report Viewer Search vendor "Microsoft" for product "Report Viewer" | 2008 Search vendor "Microsoft" for product "Report Viewer" and version "2008" | sp1, redistributable_package |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Search vendor "Microsoft" for product "Sql Server" | 2005 Search vendor "Microsoft" for product "Sql Server" and version "2005" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Search vendor "Microsoft" for product "Sql Server" | 2005 Search vendor "Microsoft" for product "Sql Server" and version "2005" | sp2, itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Search vendor "Microsoft" for product "Sql Server" | 2005 Search vendor "Microsoft" for product "Sql Server" and version "2005" | sp2, x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Search vendor "Microsoft" for product "Sql Server" | 2005 Search vendor "Microsoft" for product "Sql Server" and version "2005" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Search vendor "Microsoft" for product "Sql Server" | 2005 Search vendor "Microsoft" for product "Sql Server" and version "2005" | sp3, itanium |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Search vendor "Microsoft" for product "Sql Server" | 2005 Search vendor "Microsoft" for product "Sql Server" and version "2005" | sp3, x64 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Sql Server Reporting Services Search vendor "Microsoft" for product "Sql Server Reporting Services" | 2000 Search vendor "Microsoft" for product "Sql Server Reporting Services" and version "2000" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Excel Viewer Search vendor "Microsoft" for product "Excel Viewer" | 2003 Search vendor "Microsoft" for product "Excel Viewer" and version "2003" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Excel Viewer Search vendor "Microsoft" for product "Excel Viewer" | 2003 Search vendor "Microsoft" for product "Excel Viewer" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Expression Web Search vendor "Microsoft" for product "Expression Web" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Expression Web Search vendor "Microsoft" for product "Expression Web" | 2 Search vendor "Microsoft" for product "Expression Web" and version "2" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2003 Search vendor "Microsoft" for product "Office" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2007 Search vendor "Microsoft" for product "Office" and version "2007" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2007 Search vendor "Microsoft" for product "Office" and version "2007" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | xp Search vendor "Microsoft" for product "Office" and version "xp" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Compatibility Pack Search vendor "Microsoft" for product "Office Compatibility Pack" | 2007 Search vendor "Microsoft" for product "Office Compatibility Pack" and version "2007" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Compatibility Pack Search vendor "Microsoft" for product "Office Compatibility Pack" | 2007 Search vendor "Microsoft" for product "Office Compatibility Pack" and version "2007" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Excel Viewer Search vendor "Microsoft" for product "Office Excel Viewer" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Groove Search vendor "Microsoft" for product "Office Groove" | 2007 Search vendor "Microsoft" for product "Office Groove" and version "2007" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Groove Search vendor "Microsoft" for product "Office Groove" | 2007 Search vendor "Microsoft" for product "Office Groove" and version "2007" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Powerpoint Viewer Search vendor "Microsoft" for product "Office Powerpoint Viewer" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Powerpoint Viewer Search vendor "Microsoft" for product "Office Powerpoint Viewer" | 2007 Search vendor "Microsoft" for product "Office Powerpoint Viewer" and version "2007" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Powerpoint Viewer Search vendor "Microsoft" for product "Office Powerpoint Viewer" | 2007 Search vendor "Microsoft" for product "Office Powerpoint Viewer" and version "2007" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Word Viewer Search vendor "Microsoft" for product "Office Word Viewer" | * | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Project Search vendor "Microsoft" for product "Project" | 2002 Search vendor "Microsoft" for product "Project" and version "2002" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visio Search vendor "Microsoft" for product "Visio" | 2002 Search vendor "Microsoft" for product "Visio" and version "2002" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Word Viewer Search vendor "Microsoft" for product "Word Viewer" | 2003 Search vendor "Microsoft" for product "Word Viewer" and version "2003" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Word Viewer Search vendor "Microsoft" for product "Word Viewer" | 2003 Search vendor "Microsoft" for product "Word Viewer" and version "2003" | sp3 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Works Search vendor "Microsoft" for product "Works" | 8.5 Search vendor "Microsoft" for product "Works" and version "8.5" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Platform Sdk Search vendor "Microsoft" for product "Platform Sdk" | * | redistrutable_gdi\+ |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Report Viewer Search vendor "Microsoft" for product "Report Viewer" | 2005 Search vendor "Microsoft" for product "Report Viewer" and version "2005" | sp1, redistributable_package |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Report Viewer Search vendor "Microsoft" for product "Report Viewer" | 2008 Search vendor "Microsoft" for product "Report Viewer" and version "2008" | redistributable_package |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Report Viewer Search vendor "Microsoft" for product "Report Viewer" | 2008 Search vendor "Microsoft" for product "Report Viewer" and version "2008" | sp1, redistributable_package |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio Search vendor "Microsoft" for product "Visual Studio" | 2008 Search vendor "Microsoft" for product "Visual Studio" and version "2008" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio Search vendor "Microsoft" for product "Visual Studio" | 2008 Search vendor "Microsoft" for product "Visual Studio" and version "2008" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio .net Search vendor "Microsoft" for product "Visual Studio .net" | 2003 Search vendor "Microsoft" for product "Visual Studio .net" and version "2003" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Visual Studio .net Search vendor "Microsoft" for product "Visual Studio .net" | 2005 Search vendor "Microsoft" for product "Visual Studio .net" and version "2005" | sp1 |
Affected
| ||||||