Evil-DB LogoEvil-DB
← All CVEs

CVE-2009-0323

high · 10

Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function; (2) an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function; and unspecified vectors in (3) html2thot.c and (4) xml2thot.c, related to the msgBuffer variable. NOTE: these are different vectors than CVE-2008-6005.

10
CVSS
62.5%
EPSS (exploit prob.)
99th
EPSS percentile
2009-01-28
Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

CWE-119

Affected products

VendorProductAffected versions
w3amaya<= 11.0
w3amaya0.9
w3amaya0.95b
w3amaya1.0
w3amaya1.0a
w3amaya1.1
w3amaya1.1a
w3amaya1.1c
w3amaya1.2
w3amaya1.2a
w3amaya1.3
w3amaya1.3a
w3amaya1.3b
w3amaya1.4
w3amaya1.4a
w3amaya2.0
w3amaya2.1
w3amaya2.2
w3amaya2.3
w3amaya2.4
w3amaya3.0
w3amaya3.1
w3amaya3.2
w3amaya3.2.1
w3amaya4.0
w3amaya4.1
w3amaya4.2
w3amaya4.2.1
w3amaya4.3
w3amaya4.3.1
w3amaya4.3.2
w3amaya5.0
w3amaya5.1
w3amaya5.2
w3amaya5.3
w3amaya6.0
w3amaya6.1
w3amaya6.2
w3amaya6.3
w3amaya6.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-0323