Veille CVE
CVE-2009-1537
8.8 Élevée Exploitée activementCatalogue CISA KEV — Microsoft DirectX NULL Byte Overwrite Vulnerability
Ajoutée le 20/05/2026 · Échéance de correction (agences US) : 03/06/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | 9.3 Élevée | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx Vendor Advisory
- http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx Vendor Advisory
- http://isc.sans.org/diary.html?storyid=6481 Not Applicable
- http://osvdb.org/54797 Broken Link
- http://secunia.com/advisories/35268 Vendor Advisory
- http://www.microsoft.com/technet/security/advisory/971778.mspx PatchVendor Advisory
- http://www.securityfocus.com/bid/35139 Broken Link
- http://www.securitytracker.com/id?1022299 Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-195A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/1445 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1886 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237 Broken Link
- http://blogs.technet.com/msrc/archive/2009/05/28/microsoft-security-advisory-971778-vulnerability-in-microsoft-directshow-released.aspx Vendor Advisory
- http://blogs.technet.com/srd/archive/2009/05/28/new-vulnerability-in-quicktime-parsing.aspx Vendor Advisory
- http://isc.sans.org/diary.html?storyid=6481 Not Applicable
- http://osvdb.org/54797 Broken Link
- http://secunia.com/advisories/35268 Vendor Advisory
- http://www.microsoft.com/technet/security/advisory/971778.mspx PatchVendor Advisory
- http://www.securityfocus.com/bid/35139 Broken Link
- http://www.securitytracker.com/id?1022299 Broken Link
- http://www.us-cert.gov/cas/techalerts/TA09-195A.html US Government Resource
- http://www.vupen.com/english/advisories/2009/1445 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1886 Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6237 Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1537 US Government Resource