CVE-2009-1532

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via "malformed row property references" that trigger an access of an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Objects Memory Corruption Vulnerability" or "HTML Object Memory Corruption Vulnerability."

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/54951Broken Link
http://www.securityfocus.com/archive/1/504208/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022350Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlBroken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1538Broken Link, Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-041Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6244Broken Link
http://osvdb.org/54951Broken Link
http://www.securityfocus.com/archive/1/504208/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022350Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlBroken Link, Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1538Broken Link, Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-041Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6244Broken Link

Timeline

Published: Jun 10, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-15339.3Buffer overflow in the Works for Windows document converters in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, Office 2007 SP1, CVE-2009-15349.3Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Compo CVE-2009-15357.5The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mec CVE-2009-15362.6ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not prope CVE-2009-15378.8Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows CVE-2009-15389.3The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and CVE-2009-15399.3The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and CVE-2009-15429.0The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not e CVE-2009-15448.8Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted CVE-2009-15459.3Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Se CVE-2009-15468.5Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute ar CVE-2009-15478.8Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a c