9.3

CVE-2009-3037

Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer (aka File Viewer for Excel), as used in IBM Lotus Notes 5.x through 8.5.x, Symantec Mail Security, Symantec BrightMail Appliance, Symantec Data Loss Prevention (DLP), and other products, allows remote attackers to execute arbitrary code via a crafted .xls spreadsheet attachment.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ibm ≫ Lotus Notes Version 5.0
Ibm ≫ Lotus Notes Version 5.0.1
Ibm ≫ Lotus Notes Version 5.0.2
Ibm ≫ Lotus Notes Version 5.0.3
Ibm ≫ Lotus Notes Version 5.0.4
Ibm ≫ Lotus Notes Version 5.0.5
Ibm ≫ Lotus Notes Version 5.0.6
Ibm ≫ Lotus Notes Version 5.0.9a
Ibm ≫ Lotus Notes Version 5.0.10
Ibm ≫ Lotus Notes Version 5.0.11
Ibm ≫ Lotus Notes Version 5.0.12
Ibm ≫ Lotus Notes Version 5.02
Ibm ≫ Lotus Notes Version 6.0
Ibm ≫ Lotus Notes Version 6.0.1
Ibm ≫ Lotus Notes Version 6.0.2
Ibm ≫ Lotus Notes Version 6.0.3
Ibm ≫ Lotus Notes Version 6.0.4
Ibm ≫ Lotus Notes Version 6.0.5
Ibm ≫ Lotus Notes Version 6.5
Ibm ≫ Lotus Notes Version 6.5.1
Ibm ≫ Lotus Notes Version 6.5.2
Ibm ≫ Lotus Notes Version 6.5.3
Ibm ≫ Lotus Notes Version 6.5.4
Ibm ≫ Lotus Notes Version 6.5.5
Ibm ≫ Lotus Notes Version 6.5.5 Edition fp2
Ibm ≫ Lotus Notes Version 6.5.5 Edition fp3
Ibm ≫ Lotus Notes Version 6.5.6
Ibm ≫ Lotus Notes Version 6.5.6 Edition fp2
Ibm ≫ Lotus Notes Version 7.0
Ibm ≫ Lotus Notes Version 7.0.0
Ibm ≫ Lotus Notes Version 7.0.1
Ibm ≫ Lotus Notes Version 7.0.2
Ibm ≫ Lotus Notes Version 7.0.2 Edition fp1
Ibm ≫ Lotus Notes Version 7.0.3
Ibm ≫ Lotus Notes Version 8.0
Ibm ≫ Lotus Notes Version 8.0.0
Ibm ≫ Lotus Notes Version 8.0.1
Ibm ≫ Lotus Notes Version 8.5
Symantec ≫ Brightmail Appliance Version 5.0
Symantec ≫ Brightmail Appliance Version 8.0.0
Symantec ≫ Brightmail Appliance Version 8.0.1
Symantec ≫ Data Loss Prevention Detection Servers Version 8.1.1 Edition linux
Symantec ≫ Data Loss Prevention Detection Servers Version 8.1.1 Edition windows
Symantec ≫ Data Loss Prevention Detection Servers Version 9.0.1 Edition linux
Symantec ≫ Data Loss Prevention Detection Servers Version 9.0.1 Edition windows
Symantec ≫ Mail Security Version 5.0 Edition smtp
Symantec ≫ Mail Security Version 5.0.0 Edition smtp
Symantec ≫ Mail Security Version 5.0.1 Edition smtp
Symantec ≫ Mail Security Version 5.0.1.181 Edition smtp
Symantec ≫ Mail Security Version 5.0.1.182 Edition smtp
Symantec ≫ Mail Security Version 5.0.1.189 Edition smtp
Symantec ≫ Mail Security Version 5.0.1.200 Edition smtp
Symantec ≫ Mail Security Version 5.0.10 Edition microsoft_exchange
Symantec ≫ Mail Security Version 5.0.11 Edition microsoft_exchange
Symantec ≫ Mail Security Version 5.0.12 Edition microsoft_exchange
Symantec ≫ Mail Security Version 6.0.6 Edition microsoft_exchange
Symantec ≫ Mail Security Version 6.0.7 Edition microsoft_exchange
Symantec ≫ Mail Security Version 6.0.8 Edition microsoft_exchange
Symantec ≫ Mail Security Version 7.5.3.25 Edition domino
Symantec ≫ Mail Security Version 7.5.4.29 Edition domino
Symantec ≫ Mail Security Version 7.5.5.32 Edition domino
Symantec ≫ Mail Security Version 7.5.6 Edition domino
Symantec ≫ Mail Security Version 8.0 Edition domino
Symantec ≫ Mail Security Appliance Version 5.0.0.24
Symantec ≫ Mail Security Appliance Version 5.0.0.36
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.72% 0.92
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://secunia.com/advisories/36472
Vendor Advisory
http://secunia.com/advisories/36474
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21396492
Patch
Vendor Advisory
http://www.securityfocus.com/bid/36042
http://www.securityfocus.com/bid/36124
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090825_00
http://www.vupen.com/english/advisories/2009/2389
Patch
Vendor Advisory