CVE-2009-3691

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM Informix Client SDK 3.0 and 3.50 and Informix Connect Runtime 3.x allow remote attackers to execute arbitrary code via a .nfx file with a crafted (1) HostSize, and possibly (2) ProtoSize and (3) ServerSize, field that triggers a stack-based buffer overflow involving a crafted HostList field. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-189

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2009
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2009

CVE-2009-36927.2Unspecified vulnerability in the VBoxNetAdpCtl configuration tool in Sun VirtualBox 3.0.x before 3.0.8 on Solaris x86, Linux, and Mac OS X aCVE-2009-36939.3Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to creCVE-2009-36946.8Directory traversal vulnerability in config/config.php in ezRecipe-Zee 91, when register_globals is enabled, allows remote attackers to inclCVE-2009-36955.0Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause aCVE-2009-36964.3Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbitCVE-2009-36977.5SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remCVE-2009-36984.3An unspecified function in the Dalvik API in Android 1.5 and earlier allows remote attackers to cause a denial of service (system process reCVE-2009-369910.0Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 CVE-2009-37005.0Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote attackers to cause a denial of service (application hang or loss of blockCVE-2009-37014.3Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde GroupCVE-2009-37027.5Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 allow remote attackers to include and execute arbitrary local files viaCVE-2009-37037.5Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL comma
CVE-2009-3691: Critical severity, CVSS 9.3 | Vulnix