CVE-2009-2504 (CNNVD-200910-216)

CRITICAL
中文标题:
Microsoft GDI+ .NET Framework 远程代码执行漏洞
英文标题:
Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Fra...
CVSS分数: 9.3
发布时间: 2009-10-14 10:00:00
漏洞类型: 数字错误
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1和SP2, Windows XP SP2 和 SP3, Windows Server 2003 SP2, Vista Gold 和 SP1, Server 2008 Gold, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1和SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold和SP3, Office Excel Viewer 2003 Gold 和SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, 和SP2, Word的微软Office文件格式兼容套装, Excel, 和PowerPoint 2007 File Formats SP1和SP2, Expression Web, Expression Web 2, Groove 2007 Gold 和 SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 和 SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold 和 SP1,以及Forefront Client Security 1.0版本的GDI+的未明APIs中存在多个整数值溢出。远程攻击者可以借助(1)特制的XAML浏览器应用程序(XBAP), (2)特制的ASP.NET应用程序或(3)特制的.NET Framework applicati!，执行任意代码。该漏洞又称"GDI+ .NET API漏洞"。

英文描述:

Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server 2008 Gold, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allow remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka "GDI+ .NET API Vulnerability."

CWE类型:
CWE-189
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
microsoft windows_2003_server * - - cpe:2.3:o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*
microsoft windows_server_2008 * - - cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:*
microsoft windows_vista * - - cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*
microsoft windows_xp * - - cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoft .net_framework 1.1 - - cpe:2.3:a:microsoft:.net_framework:1.1:sp1:*:*:*:*:*:*
microsoft .net_framework 2.0 - - cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:*
microsoft internet_explorer 6 - - cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*
microsoft report_viewer 2005 - - cpe:2.3:a:microsoft:report_viewer:2005:sp1:redistributable_package:*:*:*:*:*
microsoft report_viewer 2008 - - cpe:2.3:a:microsoft:report_viewer:2008:*:redistributable_package:*:*:*:*:*
microsoft sql_server 2005 - - cpe:2.3:a:microsoft:sql_server:2005:sp2:*:*:*:*:*:*
microsoft sql_server_reporting_services 2000 - - cpe:2.3:a:microsoft:sql_server_reporting_services:2000:sp2:*:*:*:*:*:*
microsoft excel_viewer 2003 - - cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*
microsoft expression_web * - - cpe:2.3:a:microsoft:expression_web:*:*:*:*:*:*:*:*
microsoft expression_web 2 - - cpe:2.3:a:microsoft:expression_web:2:*:*:*:*:*:*:*
microsoft office 2003 - - cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
microsoft office 2007 - - cpe:2.3:a:microsoft:office:2007:sp1:*:*:*:*:*:*
microsoft office xp - - cpe:2.3:a:microsoft:office:xp:*:*:*:*:*:*:*
microsoft office_compatibility_pack 2007 - - cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
microsoft office_excel_viewer * - - cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
microsoft office_groove 2007 - - cpe:2.3:a:microsoft:office_groove:2007:*:*:*:*:*:*:*
microsoft office_powerpoint_viewer * - - cpe:2.3:a:microsoft:office_powerpoint_viewer:*:*:*:*:*:*:*:*
microsoft office_powerpoint_viewer 2007 - - cpe:2.3:a:microsoft:office_powerpoint_viewer:2007:sp1:*:*:*:*:*:*
microsoft office_word_viewer * - - cpe:2.3:a:microsoft:office_word_viewer:*:*:*:*:*:*:*:*
microsoft project 2002 - - cpe:2.3:a:microsoft:project:2002:sp1:*:*:*:*:*:*
microsoft visio 2002 - - cpe:2.3:a:microsoft:visio:2002:sp2:*:*:*:*:*:*
microsoft word_viewer 2003 - - cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*
microsoft works 8.5 - - cpe:2.3:a:microsoft:works:8.5:*:*:*:*:*:*:*
microsoft platform_sdk * - - cpe:2.3:a:microsoft:platform_sdk:*:*:redistrutable_gdi\+:*:*:*:*:*
microsoft visual_studio 2008 - - cpe:2.3:a:microsoft:visual_studio:2008:*:*:*:*:*:*:*
microsoft visual_studio_.net 2003 - - cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*
microsoft visual_studio_.net 2005 - - cpe:2.3:a:microsoft:visual_studio_.net:2005:sp1:*:*:*:*:*:*
microsoft forefront_client_security 1.0 - - cpe:2.3:a:microsoft:forefront_client_security:1.0:*:*:*:*:*:*:*
microsoft visual_foxpro 8.0 - - cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
microsoft visual_foxpro 9.0 - - cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
oval:org.mitre.oval:def:6282 vdb-entry
cve.org
访问
TA09-286A third-party-advisory
cve.org
访问
MS09-062 vendor-advisory
cve.org
访问
CVSS评分详情
9.3
CRITICAL
CVSS向量: AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS版本: 2.0
机密性
COMPLETE
完整性
COMPLETE
可用性
COMPLETE
时间信息
发布时间:
2009-10-14 10:00:00
修改时间:
2024-08-07 05:52:14
创建时间:
2025-11-11 15:33:02
更新时间:
2025-11-11 15:49:39
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2009-2504 2025-11-11 15:18:10 2025-11-11 07:33:02
NVD nvd_CVE-2009-2504 2025-11-11 14:53:01 2025-11-11 07:41:49
CNNVD cnnvd_CNNVD-200910-216 2025-11-11 15:09:07 2025-11-11 07:49:39
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:49:39
vulnerability_type: 未提取 → 数字错误; cnnvd_id: 未提取 → CNNVD-200910-216; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 数字错误
  • cnnvd_id: 未提取 -> CNNVD-200910-216
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:41:49
severity: SeverityLevel.MEDIUM → SeverityLevel.CRITICAL; cvss_score: 未提取 → 9.3; cvss_vector: NOT_EXTRACTED → AV:N/AC:M/Au:N/C:C/I:C/A:C; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 34; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
  • cvss_score: 未提取 -> 9.3
  • cvss_vector: NOT_EXTRACTED -> AV:N/AC:M/Au:N/C:C/I:C/A:C
  • cvss_version: NOT_EXTRACTED -> 2.0
  • affected_products_count: 0 -> 34
  • data_sources: ['cve'] -> ['cve', 'nvd']