CVE-2009-3678

Description

Integer overflow in cdd.dll in the Canonical Display Driver (CDD) in Microsoft Windows Server 2008 R2 and Windows 7 on 64-bit platforms, when the Windows Aero theme is installed, allows context-dependent attackers to cause a denial of service (reboot) or possibly execute arbitrary code via a crafted image file that triggers incorrect data parsing after user-mode data is copied to kernel mode, as demonstrated using Browse with Irfanview and certain actions on a folder containing a large number of thumbnail images in Resample mode, possibly related to the ATI graphics driver or win32k.sys, aka Canonical Display Driver Integer Overflow Vulnerability.

Risk Information

Base Score

8.4

MODERATE

Vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

52.132

Associated Vulnerability

Vulnerability	OS Platform
ms10-043: vulnerability in canonical display driver could allow remote code execution for Windows 7 for x64-based Systems (KB2032276)	Windows
ms10-043: vulnerability in canonical display driver could allow remote code execution for Windows Server 2008 R2 x64 Edition (KB2032276)	Windows

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-8800	Security Update for Windows 7 for x64-based Systems (KB2032276)
PATCH-8801	Security Update for Windows Server 2008 R2 x64 Edition (KB2032276)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234