CVE-2009-1546
Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 22.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP SP2 or SP3, Server 2003 SP2, Vista Gold, SP1, or SP2, or Server 2008 Gold or SP2 system via a crafted AVI file, aka "AVI Integer Overflow Vulnerability."
- CVSS 2.0
- 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
- EPSS
- 22.46% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- microsoft/windows 2003 server · microsoft/windows server 2008 · microsoft/windows vista · microsoft/windows xp
- Source
- secure@microsoft.com
References
- http://osvdb.org/56909
- http://secunia.com/advisories/36206Vendor Advisory
- http://www.securityfocus.com/bid/35970Patch
- http://www.securitytracker.com/id?1022711
- http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/2233Patch, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-038
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5930
- http://osvdb.org/56909
- http://secunia.com/advisories/36206Vendor Advisory
- http://www.securityfocus.com/bid/35970Patch
- http://www.securitytracker.com/id?1022711
- http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/2233Patch, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-038
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5930
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.