Unscored severity · published Jan 28, 2009
CVE-2009-0323
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which…
–
CVSS
62.5%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable. NOTE: these are different vectors than CVE-2008-6005.
Exploitation
Is it being used?
Exploit prediction (EPSS)62.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Amaya · W3
through 11.0; 0.9; 0.95b; 1.0; 1.0a; 1.1; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0323
Exploit
http://www.coresecurity.com/content/amaya-buffer-overflows
www.securityfocus.com
http://www.securityfocus.com/archive/1/500492/100/0/threaded
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/48325
www.exploit-db.com
https://www.exploit-db.com/exploits/7902
More from Amaya
–
CVE-2009-1209
Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long defer attribute