Veille CVE
CVE-2009-0556
8.8 Élevée Exploitée activementCatalogue CISA KEV — Microsoft Office PowerPoint Code Injection Vulnerability
Ajoutée le 07/01/2026 · Échéance de correction (agences US) : 28/01/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | 9.3 Élevée | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx Vendor Advisory
- http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx Vendor Advisory
- http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx Vendor Advisory
- http://osvdb.org/53182 Broken Link
- http://secunia.com/advisories/34572 Vendor Advisory
- http://www.kb.cert.org/vuls/id/627331 US Government Resource
- http://www.microsoft.com/technet/security/advisory/969136.mspx PatchVendor Advisory
- http://www.securityfocus.com/archive/1/503453/100/0/threaded Broken Link
- http://www.securityfocus.com/bid/34351 Broken Link
- http://www.securitytracker.com/id?1021967 Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-132A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/0915 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1290 Broken Link
- http://www.zerodayinitiative.com/advisories/ZDI-09-019 Third Party Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49632 Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204 Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279 Broken Link
- http://blogs.technet.com/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx Vendor Advisory
- http://blogs.technet.com/msrc/archive/2009/04/02/microsoft-security-advisory-969136.aspx Vendor Advisory
- http://blogs.technet.com/srd/archive/2009/04/02/investigating-the-new-powerpoint-issue.aspx Vendor Advisory
- http://osvdb.org/53182 Broken Link
- http://secunia.com/advisories/34572 Vendor Advisory
- http://www.kb.cert.org/vuls/id/627331 US Government Resource
- http://www.microsoft.com/technet/security/advisory/969136.mspx PatchVendor Advisory
- http://www.securityfocus.com/archive/1/503453/100/0/threaded Broken Link
- http://www.securityfocus.com/bid/34351 Broken Link
- http://www.securitytracker.com/id?1021967 Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-132A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/0915 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1290 Broken Link
- http://www.zerodayinitiative.com/advisories/ZDI-09-019 Third Party Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49632 Third Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6204 Broken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6279 Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-0556 US Government Resource