CVE-2009-1515

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-05-04 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file. NOTE: some of these details are obtained from third party information.

Affected products

Christos Zoulas File: 5.00

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515603
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525820
http://mx.gw.com/pipermail/file/2009/000379.html
http://secunia.com/advisories/34881
http://www.mandriva.com/security/advisories?name=MDVSA-2009:129
http://www.osvdb.org/54100
http://www.securityfocus.com/bid/34745
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515603
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525820
http://mx.gw.com/pipermail/file/2009/000379.html

Get alerted when CVE-2009-1515 or the next vulnerability affects your stack