CVE-2009-1529

Summary

CVE	CVE-2009-1529
State	PUBLISHED
Assigner	microsoft
Source Priority	CVE Program / NVD first with legacy fallback
Published	2009-06-10 18:30:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by calling the setCapture method on a collection of crafted objects, aka "Uninitialized Memory Corruption Vulnerability."

Primary CVSS: v3.1 8.1 HIGH from ADP

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-399 | CWE-908 | n/a | CWE-908 CWE-908 Use of Uninitialized Resource

Version	Source	Type	Score	Severity	Vector
3.1	ADP	DECLARED	8.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	8.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	9.3		`AV:N/AC:M/Au:N/C:C/I:C/A:C`

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Application	Microsoft	Internet Explorer	6	All	All	All
Application	Microsoft	Internet Explorer	7	All	All	All
Operating System	Microsoft	Windows Server 2003	All	All	All	All
Operating System	Microsoft	Windows Server 2003	All	sp1	All	All
Operating System	Microsoft	Windows Server 2003	All	sp1	itanium	All
Operating System	Microsoft	Windows Server 2003	All	sp2	All	All
Operating System	Microsoft	Windows Xp	All	All	pro_x64	All
Operating System	Microsoft	Windows Xp	All	sp2	All	All
Operating System	Microsoft	Windows Xp	All	sp2	pro_x64	All
Operating System	Microsoft	Windows Xp	All	sp3	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified
ADP	Microsoft	Ie	affected Windows XP SP2	Not specified
ADP	Microsoft	Ie	affected Windows XP SP3	Not specified
ADP	Microsoft	Ie	affected Windows Server 2003 SP2	Not specified
ADP	Microsoft	Ie	affected Windows Vista Gold	Not specified
ADP	Microsoft	Ie	affected Windows Vista SP1	Not specified
ADP	Microsoft	Ie	affected Windows Vista SP2	Not specified
ADP	Microsoft	Ie	affected Windows Server 2008 SP2	Not specified

Reference	Source	Link	Tags
504 Gateway Time-out	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
US-CERT Technical Cyber Security Alert TA09-160A -- Microsoft Updates for Multiple Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.us-cert.gov	US Government Resource
SecurityTracker.com Archives - Microsoft Internet Explorer Bugs Let Remote Users Execute Arbitrary Code	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com	Vendor Advisory
Zero Day Initiative	af854a3a-2127-422b-91ae-364da2661108	www.zerodayinitiative.com
SecurityFocus	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
Repository / Oval Repository	af854a3a-2127-422b-91ae-364da2661108	oval.cisecurity.org
Microsoft Security Bulletin MS09-019 - Critical \| Microsoft Docs	af854a3a-2127-422b-91ae-364da2661108	docs.microsoft.com
osvdb.org/54948	af854a3a-2127-422b-91ae-364da2661108	osvdb.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.