# CVEs published 2009-12-09

14 CVEs were published on December 9, 2009: 0 critical, 1 high. Days are UTC.

- [CVE-2009-4239](https://cve.now/CVE-2009-4239.md): Cross-site scripting (XSS) vulnerability in the Web console in IBM InfoSphere Information Server 8.1 before FP1 allows remote attackers to i (no CVSS)
- [CVE-2009-4240](https://cve.now/CVE-2009-4240.md): Multiple buffer overflows in unspecified setuid executables in the DataStage subsystem in IBM InfoSphere Information Server 8.1 before FP1 h (no CVSS)
- [CVE-2009-0102](https://cve.now/CVE-2009-0102.md): Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which al (no CVSS)
- [CVE-2009-2505](https://cve.now/CVE-2009-2505.md): The Internet Authentication Service (IAS) in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected (no CVSS)
- [CVE-2009-2506](https://cve.now/CVE-2009-2506.md): Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Win (no CVSS)
- [CVE-2009-2508](https://cve.now/CVE-2009-2508.md): The single sign-on implementation in Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold a (no CVSS)
- [CVE-2009-2509](https://cve.now/CVE-2009-2509.md): Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate hea (no CVSS)
- [CVE-2009-3671](https://cve.now/CVE-2009-3671.md): Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi (CVSS 8.1)
- [CVE-2009-3673](https://cve.now/CVE-2009-3673.md): Microsoft Internet Explorer 7 and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by a (no CVSS)
- [CVE-2009-3674](https://cve.now/CVE-2009-3674.md): Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi (no CVSS)
- [CVE-2009-3675](https://cve.now/CVE-2009-3675.md): LSASS.exe in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allow (no CVSS)
- [CVE-2009-3677](https://cve.now/CVE-2009-3677.md): The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 200 (no CVSS)
- [CVE-2009-4149](https://cve.now/CVE-2009-4149.md): Cross-site scripting (XSS) vulnerability in the web interface in CA Service Desk 12.1 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-3563](https://cve.now/CVE-2009-3563.md): ntp\_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.