Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-0901 Details

Description

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx	CVE
http://marc.info/?l=bugtraq&m=126592505426855&w=2	CVE
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035	CVE
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037	CVE
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060	CVE
http://secunia.com/advisories/35967	CVE
http://secunia.com/advisories/36187	CVE
http://secunia.com/advisories/36374	CVE
http://secunia.com/advisories/36746	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6289	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6311	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6373	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7581	CVE
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1	CVE
http://www.adobe.com/support/security/advisories/apsa09-04.html	CVE	Patch
http://www.adobe.com/support/security/bulletins/apsb09-10.html	CVE
http://www.adobe.com/support/security/bulletins/apsb09-11.html	CVE	Patch
http://www.adobe.com/support/security/bulletins/apsb09-13.html	CVE
http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1	CVE
http://www.securityfocus.com/bid/35832	CVE	Patch
http://www.us-cert.gov/cas/techalerts/TA09-195A.html	CVE	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-223A.html	CVE	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-286A.html	CVE	US Government Resource
http://www.vupen.com/english/advisories/2009/2034	CVE
http://www.vupen.com/english/advisories/2009/2232	CVE
http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx	[email protected]
http://marc.info/?l=bugtraq&m=126592505426855&w=2	[email protected]
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035	[email protected]
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037	[email protected]
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060	[email protected]
http://secunia.com/advisories/35967	[email protected]
http://secunia.com/advisories/36187	[email protected]
http://secunia.com/advisories/36374	[email protected]
http://secunia.com/advisories/36746	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6289	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6311	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6373	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7581	[email protected]
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1	[email protected]
http://www.adobe.com/support/security/advisories/apsa09-04.html	[email protected]	Patch
http://www.adobe.com/support/security/bulletins/apsb09-10.html	[email protected]
http://www.adobe.com/support/security/bulletins/apsb09-11.html	[email protected]	Patch
http://www.adobe.com/support/security/bulletins/apsb09-13.html	[email protected]
http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1	[email protected]
http://www.securityfocus.com/bid/35832	[email protected]	Patch
http://www.us-cert.gov/cas/techalerts/TA09-195A.html	[email protected]	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-223A.html	[email protected]	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-286A.html	[email protected]	US Government Resource
http://www.vupen.com/english/advisories/2009/2034	[email protected]
http://www.vupen.com/english/advisories/2009/2232	[email protected]

see all 50 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-94	Improper Control of Generation of Code ('Code Injection')	[email protected]
CWE-457	Use of Uninitialized Variable	CISA-ADP

Affected Products

Product	Versions
microsoft visual c++	2005 sp1_redistribution_pkg 2008 redistribution_pkg 2008 sp1_redistribution_pkg
CPE cpe:2.3:a:microsoft:visual_c++:2005:sp1_redistribution_pkg:::::: cpe:2.3:a:microsoft:visual_c++:2008:redistribution_pkg:::::: cpe:2.3:a:microsoft:visual_c++:2008:sp1_redistribution_pkg:::::: Remediation No remediation found in references.
microsoft visual studio	2005 sp1 2008 2008 sp1
CPE cpe:2.3:a:microsoft:visual_studio:2005:sp1:::::: cpe:2.3:a:microsoft:visual_studio:2005:sp1:64_bit_hosted_visual_c++_tools:::::* cpe:2.3:a:microsoft:visual_studio:2008:::::::* cpe:2.3:a:microsoft:visual_studio:2008:sp1:::::: Remediation No remediation found in references.
microsoft visual studio .net	2003 sp1
CPE cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:::::: Remediation No remediation found in references.

Change History

10 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	CISA-ADP
Jun 16, 2026	CVE Modified	[email protected]
May 27, 2026	CVE Modified	CISA-ADP
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 12, 2018	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Nov 14, 2014	CVE Modified	[email protected]
Jul 29, 2009	Initial Analysis	[email protected]

CVE-2009-0901 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO