CVE-2009-2495: Infoleak
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2495?
CVE-2009-2495 has a high severity due to potential sensitive information disclosure.
How do I fix CVE-2009-2495?
To fix CVE-2009-2495, apply the latest security updates from Microsoft for the affected software versions.
What software is affected by CVE-2009-2495?
CVE-2009-2495 affects Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1, Visual Studio 2008, and their respective Visual C++ versions.
Can CVE-2009-2495 be exploited remotely?
Yes, CVE-2009-2495 can be exploited remotely through a crafted HTML document.
What types of information can be disclosed by exploiting CVE-2009-2495?
Exploiting CVE-2009-2495 may allow attackers to obtain sensitive information from the affected applications.