CVE-2009-0901 Common Vulnerabilities and Exposures

Upstream information

CVE-2009-0901 at MITRE

Description

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
Access Vector	Network
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

SUSE-SA:2009:041, published Wed, 05 Aug 2009 14:00:00 +0000

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Linux Enterprise Desktop 12 SP1	`flash-player >= 11.2.202.548-111.1` `flash-player-gnome >= 11.2.202.548-111.1`	Patchnames: SUSE Linux Enterprise Desktop 12 SP1 GA flash-player-11.2.202.548-111.1 SUSE Linux Enterprise Workstation Extension 12 SP1 GA flash-player-11.2.202.548-111.1
SUSE Linux Enterprise Desktop 12	`flash-player >= 11.2.202.406-1.3` `flash-player-gnome >= 11.2.202.406-1.3`	Patchnames: SUSE Linux Enterprise Desktop 12 GA flash-player-11.2.202.406-1.3 SUSE Linux Enterprise Workstation Extension 12 GA flash-player-11.2.202.406-1.3
SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Workstation Extension 12 SP1	`flash-player >= 11.2.202.548-111.1` `flash-player-gnome >= 11.2.202.548-111.1`	Patchnames: SUSE Linux Enterprise Workstation Extension 12 SP1 GA flash-player-11.2.202.548-111.1
SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Workstation Extension 12	`flash-player >= 11.2.202.406-1.3` `flash-player-gnome >= 11.2.202.406-1.3`	Patchnames: SUSE Linux Enterprise Workstation Extension 12 GA flash-player-11.2.202.406-1.3

SUSE Timeline for this CVE

CVE page created: Fri Jun 28 03:48:42 2013
CVE page last modified: Sat Jun 15 20:55:36 2024