Patch Tuesday, June 2009
Microsoft's monthly security release, Tuesday, June 9, 2009. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
3 CVEs · 0 critical · 3 exploited · 0 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
3 CVEs · 0 critical · 3 exploited · 0 with public exploit code
- 7.8HighJun 10, 2009Microsoft Office Code / command injectionCVE-2009-0557Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.Exploited53% likely
- 7.8HighJun 10, 2009Microsoft Office Memory corruptionCVE-2009-0563Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.Exploited60% likely
- 7.8HighJun 10, 2009Microsoft WindowsCVE-2009-1123The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.Exploited4.9% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.