CVE-2009-0084

Use-after-free vulnerability in DirectShow in Microsoft DirectX 8.1 and 9.0 allows remote attackers to execute arbitrary code via an MJPEG file or video stream with a malformed Huffman table, which triggers an exception that frees heap memory that is later accessed, aka "MJPEG Decompression Vulnerability."
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
microsoftdirectx
8.1
microsoftdirectx
9.0
microsoftdirectx
9.0a:a
microsoftdirectx
9.0b:b
microsoftdirectx
9.0c:c
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/53632
http://secunia.com/advisories/34665
http://support.avaya.com/elmodocs2/security/ASA-2009-132.htm
http://www.piotrbania.com/all/adv/ms-directx-mjpeg-adv.txt
http://www.securityfocus.com/bid/34460
http://www.securitytracker.com/id?1022040
http://www.us-cert.gov/cas/techalerts/TA09-104A.html
http://www.vupen.com/english/advisories/2009/1025
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-011
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5618
http://osvdb.org/53632
http://secunia.com/advisories/34665
http://support.avaya.com/elmodocs2/security/ASA-2009-132.htm
http://www.piotrbania.com/all/adv/ms-directx-mjpeg-adv.txt
http://www.securityfocus.com/bid/34460
http://www.securitytracker.com/id?1022040
http://www.us-cert.gov/cas/techalerts/TA09-104A.html
http://www.vupen.com/english/advisories/2009/1025
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-011
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5618