Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Oracle Siebel IE add‑on can run malicious code

CVE-2009-3737 · published 16 years ago
Summary

The Oracle Siebel Option Pack for Internet Explorer includes an ActiveX control that fails to clear memory before using it. Because of this, a specially crafted web page could cause the control to run any code the attacker wants on a visitor’s computer. Apply the vendor’s update or disable the control to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle siebel_option_pack_ie_activex_control All versions
cpe:2.3:a:oracle:siebel_option_pack_ie_activex_control:*:*:*:*:*:*:*:*
Original advisory text
The Oracle Siebel Option Pack for IE ActiveX control does not properly initialize memory that is used by the NewBusObj method, which allows remote attackers to execute arbitrary code via a crafted ...
The Oracle Siebel Option Pack for IE ActiveX control does not properly initialize memory that is used by the NewBusObj method, which allows remote attackers to execute arbitrary code via a crafted HTML document.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published17 Aug 2010
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-3737 · NVD
Track software like this
Free during beta