Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2009-0850: BitDefender Internet Security 2009 runs code from crafted file names
CVE-2009-0850 · published 17 years ago
Summary
BitDefender Internet Security 2009 can execute malicious web code when a user opens a virus‑infected archive whose file names contain specially crafted text. An attacker who gets a victim to open such a file could steal information or perform actions on the user’s behalf. Install the latest security update from BitDefender or use a newer version of the product to stop this behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| bitdefender | internet_security |
2009 cpe:2.3:a:bitdefender:internet_security:2009:*:*:*:*:*:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web script or HTML via the filename of a virus-infected file...
Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web script or HTML via the filename of a virus-infected file, as demonstrated by a filename inside a (1) rar or (2) zip archive file.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
4.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Mar 2009
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2009-0850 · NVD
Track software like this
Free during beta