CVE-2009-0255

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/33617Broken Link, Vendor Advisory
http://secunia.com/advisories/33679Broken Link, Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/Vendor Advisory
http://www.debian.org/security/2009/dsa-1711Mailing List
http://www.securityfocus.com/bid/33376Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/48132Third Party Advisory, VDB Entry
http://secunia.com/advisories/33617Broken Link, Vendor Advisory
http://secunia.com/advisories/33679Broken Link, Vendor Advisory
http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/Vendor Advisory
http://www.debian.org/security/2009/dsa-1711Mailing List
http://www.securityfocus.com/bid/33376Broken Link, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/48132Third Party Advisory, VDB Entry

Timeline

Published: Jan 22, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-02567.5Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allo CVE-2009-02574.3Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allow remote CVE-2009-025810.0The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allow CVE-2009-02599.3The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) and possibly execute a CVE-2009-02604.3Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitr CVE-2009-02619.3Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\Def CVE-2009-02629.3Stack-based buffer overflow in Triologic Media Player 7 and 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a lo CVE-2009-026310.0Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary cod CVE-2009-026410.0Buffer overflow in the Registry Setting Tool in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier has unknown impact and attack vect CVE-2009-02657.5Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function,CVE-2009-02669.3Stack-based buffer overflow in Triologic Media Player 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long str CVE-2009-02675.0libike in Sun Solaris 9 and 10, and OpenSolaris before snv_100, does not properly check packets, which allows remote attackers to cause a de