CVE Feed

    Dashboard / CVE / CVE-2009-0901

    CVE-2009-0901

    The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."

    Published:Jul 29, 2009
    Last Modified:May 27, 2026
    EPS:Jul 29, 2009
    EPSS Score:0.80169
    CVSS Score:8.8

    Affected Products

    Vendor
    Microsoft
    Product
    Visual C\+\+
    Vendor
    Microsoft
    Product
    Visual Studio
    Vendor
    Microsoft
    Product
    Visual Studio .net

    Exploits

    No exploit reference

    Related CVEs

    CVE-2021-3146 (CVSS 7.8) — The Dolby Audio X2 (DAX2) API service before 0.8.8.90 on Windows allows local users to gain privileges.…
    CVE-2010-3190 (CVSS 7.8) — Untrusted search path vulnerability in the Microsoft Foundation Class (MFC) Library in Microsoft Visual Studio…
    CVE-2009-2493 (CVSS 8.8) — The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Go…
    CVE-2009-2495 (CVSS 6.5) — The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Go…
    CVE-2007-0842 (CVSS 5) — The 64-bit versions of Microsoft Visual C++ 8.0 standard library (MSVCR80.DLL) time functions, including (1) l…
    CVE-2004-0200 (CVSS 9.3) — Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) compone…

    References

    http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
    http://marc.info/?l=bugtraq&m=126592505426855&w=2
    http://secunia.com/advisories/35967
    http://secunia.com/advisories/36187
    http://secunia.com/advisories/36374
    http://secunia.com/advisories/36746
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
    http://www.adobe.com/support/security/advisories/apsa09-04.html
    http://www.adobe.com/support/security/bulletins/apsb09-10.html
    http://www.adobe.com/support/security/bulletins/apsb09-11.html
    http://www.adobe.com/support/security/bulletins/apsb09-13.html
    http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1
    http://www.securityfocus.com/bid/35832
    http://www.us-cert.gov/cas/techalerts/TA09-195A.html
    http://www.us-cert.gov/cas/techalerts/TA09-223A.html
    http://www.us-cert.gov/cas/techalerts/TA09-286A.html
    http://www.vupen.com/english/advisories/2009/2034
    http://www.vupen.com/english/advisories/2009/2232
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6289
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6311
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6373
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7581
    http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
    http://marc.info/?l=bugtraq&m=126592505426855&w=2
    http://secunia.com/advisories/35967
    http://secunia.com/advisories/36187
    http://secunia.com/advisories/36374
    http://secunia.com/advisories/36746
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
    http://www.adobe.com/support/security/advisories/apsa09-04.html
    http://www.adobe.com/support/security/bulletins/apsb09-10.html
    http://www.adobe.com/support/security/bulletins/apsb09-11.html
    http://www.adobe.com/support/security/bulletins/apsb09-13.html
    http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1
    http://www.securityfocus.com/bid/35832
    http://www.us-cert.gov/cas/techalerts/TA09-195A.html
    http://www.us-cert.gov/cas/techalerts/TA09-223A.html
    http://www.us-cert.gov/cas/techalerts/TA09-286A.html
    http://www.vupen.com/english/advisories/2009/2034
    http://www.vupen.com/english/advisories/2009/2232
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
    https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6289
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6311
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6373
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7581

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High