TI-2009-03774 Aliases CVE-2009-3977 GHSA-vgpc-r864-vjjj

Multiple buffer overflows in a certain ActiveX control in ActiveDom.ocx in HP OpenView…

LOW 27CWE-119Published 2009-11-19 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Multiple buffer overflows in a certain ActiveX control in ActiveDom.ocx in HP OpenView Network Node Manager (OV NNM) 7.53 might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via a long string argument to the (1) DisplayName, (2) AddGroup, (3) InstallComponent, or (4) Subscribe method. NOTE: this issue is not a vulnerability in many environments, because the control is not marked as safe for scripting and would not execute with default Internet Explorer settings.

Why it matters now

EPSS 0.02334 83rd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hp:openview_network_node_manager:7.53:::::::*	7.53	Vulnerable	Hewlett Packard Enterprise

cpe:2.3:a:hp:openview_network_node_manager:7.53:*:*:*:*:*:*:* Versions 7.53 Vulnerable ·Hewlett Packard Enterprise

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2009-3977
2026-10-03 Alias added: GHSA-vgpc-r864-vjjj

References

Exploit 2

TI-2005-02634 HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute… KEVCVSS 3.1CRITICAL 9.8
TI-2011-00250 Multiple buffer overflows in nnmRptConfig.exe in HP OpenView Network Node Manager (OV… CVSS 2.0HIGH 10.0
TI-2009-03963 Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM)… CVSS 2.0HIGH 10.0
TI-2009-03657 Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01… CVSS 2.0HIGH 10.0
TI-2008-01626 Stack-based buffer overflow in ovwparser.dll in HP OpenView Network Node Manager (OV NNM)… CVSS 2.0HIGH 10.0
TI-2011-00249 Buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and… CVSS 2.0HIGH 10.0

See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences