Unscored severity · published May 4, 2009
CVE-2009-1515
Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted…
–
CVSS
3.7%
EPSS
No
On KEV
Description
Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
File · Christos Zoulas
5.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1515
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1515
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515603
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525820
mx.gw.com
http://mx.gw.com/pipermail/file/2009/000379.html
Vendor Advisory
http://secunia.com/advisories/34881
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2009:129
More from File
6.5
CVE-2014-3478
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote…
6.5
CVE-2014-0207
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a…
6.5
CVE-2012-1571
file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read…
–
CVE-2014-3587
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows…
–
CVE-2014-3538
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a…