CVE-2009-0323 describes multiple stack-based buffer overflows in W3C Amaya Web Browser versions 10.0 and 11.0. These vulnerabilities allow remote attackers to execute arbitrary code through specially crafted input tags, HTML start tags, and other unspecified vectors related to the msgBuffer variable. With a CVSS score of 10.0, this critical vulnerability poses a severe risk, enabling complete compromise of confidentiality, integrity, and availability with low attack complexity and no authentication required. While not listed on CISA's KEV, exploit code is publicly available, including a Metasploit module and entries on ExploitDB, indicating a high potential for exploitation. Despite the availability of exploits, there is no significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 11.0CPE matchmatch criteria | cpe:2.3:a:w3:amaya:*:*:*:*:*:*:*:* | ||
0.9CPE matchmatch criteria | cpe:2.3:a:w3:amaya:0.9:*:*:*:*:*:*:* | ||
0.95bCPE matchmatch criteria | cpe:2.3:a:w3:amaya:0.95b:*:*:*:*:*:*:* | ||
1.0CPE matchmatch criteria | cpe:2.3:a:w3:amaya:1.0:*:*:*:*:*:*:* | ||
1.0aCPE matchmatch criteria | cpe:2.3:a:w3:amaya:1.0a:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.