CVE-2009-1531 : Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2;

Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code via frequent calls to the getElementsByTagName function combined with the creation of an object during reordering of elements, followed by an onreadystatechange event, which triggers an access of an object that (1) was not properly initialized or (2) is deleted, aka "HTML Object Memory Corruption Vulnerability."

Published 2009-06-10 18:30:01

Updated 2023-12-07 18:38:57

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute code

Products affected by CVE-2009-1531

Microsoft » Internet Explorer » Version: 7
cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2003
When used together with: Microsoft » Windows Server 2003 » Update SP1
When used together with: Microsoft » Windows Server 2003 » Update SP1 Itanium Edition
When used together with: Microsoft » Windows Server 2003 » Update SP2
When used together with: Microsoft » Windows Server 2008
When used together with: Microsoft » Windows Server 2008 » 32 Bit Edition
When used together with: Microsoft » Windows Server 2008 » Itanium Edition
When used together with: Microsoft » Windows Server 2008 » X64 Edition
When used together with: Microsoft » Windows Vista
When used together with: Microsoft » Windows Vista » X64 Edition
When used together with: Microsoft » Windows Vista » Update SP1
When used together with: Microsoft » Windows Vista » Version: Gold
When used together with: Microsoft » Windows Xp » X64 Edition
When used together with: Microsoft » Windows Xp » Update SP2
When used together with: Microsoft » Windows Xp » Update SP2 X64 Edition
When used together with: Microsoft » Windows Xp » Update SP3

Exploit prediction scoring system (EPSS) score for CVE-2009-1531

EPSS FAQ

69.56%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-1531

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1531

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1531

http://osvdb.org/54950
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6308

404 Not Found
http://www.securitytracker.com/id?1022350

GoDaddy Domain Name Search

CVEs referencing this url
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019

Microsoft Security Bulletin MS09-019 - Critical | Microsoft Learn

CVEs referencing this url
http://www.zerodayinitiative.com/advisories/ZDI-09-039

ZDI-09-039 | Zero Day Initiative
http://www.securityfocus.com/bid/35234
http://www.securityfocus.com/archive/1/504216/100/0/threaded
http://www.us-cert.gov/cas/techalerts/TA09-160A.html

Page Not Found | CISA
US Government Resource

CVEs referencing this url
http://www.vupen.com/english/advisories/2009/1538

Webmail: access your OVH emails on ovhcloud.com | OVHcloud
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2009-1531

Products affected by CVE-2009-1531

Exploit prediction scoring system (EPSS) score for CVE-2009-1531

CVSS scores for CVE-2009-1531

CWE ids for CVE-2009-1531

References for CVE-2009-1531