Action not permitted
Modal body text goes here.
CVE-2009-3953
Vulnerability from cvelistv5
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog
Date added: 2022-06-08
Due date: 2022-06-22
Required action: Apply updates per vendor instructions.
Used in ransomware: Unknown
Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-3953
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-07T06:45:50.938Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "name": "38138", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/38138" }, { "name": "oval:org.mitre.oval:def:8242", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "name": "RHSA-2010:0060", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html" }, { "name": "ADV-2010-0103", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "url": "http://www.vupen.com/english/advisories/2010/0103" }, { "name": "1023446", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "url": "http://www.securitytracker.com/id?1023446" }, { "name": "61690", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "url": "http://osvdb.org/61690" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "name": "acrobat-reader-u3d-code-execution(55551)", "tags": [ "vdb-entry", "x_refsource_XF", "x_transferred" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "name": "38215", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/38215" }, { "name": "SUSE-SA:2010:008", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "name": "TA10-013A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html" }, { "name": "37758", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/37758" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2010-01-12T00:00:00", "descriptions": [ { "lang": "en", "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2017-09-18T12:57:01", "orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "name": "38138", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/38138" }, { "name": "oval:org.mitre.oval:def:8242", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL" ], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "name": "RHSA-2010:0060", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html" }, { "name": "ADV-2010-0103", "tags": [ "vdb-entry", "x_refsource_VUPEN" ], "url": "http://www.vupen.com/english/advisories/2010/0103" }, { "name": "1023446", "tags": [ "vdb-entry", "x_refsource_SECTRACK" ], "url": "http://www.securitytracker.com/id?1023446" }, { "name": "61690", "tags": [ "vdb-entry", "x_refsource_OSVDB" ], "url": "http://osvdb.org/61690" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "name": "acrobat-reader-u3d-code-execution(55551)", "tags": [ "vdb-entry", "x_refsource_XF" ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "name": "38215", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/38215" }, { "name": "SUSE-SA:2010:008", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "name": "TA10-013A", "tags": [ "third-party-advisory", "x_refsource_CERT" ], "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html" }, { "name": "37758", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/37758" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "psirt@adobe.com", "ID": "CVE-2009-3953", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl", "refsource": "MISC", "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "name": "38138", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/38138" }, { "name": "oval:org.mitre.oval:def:8242", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242" }, { "name": "http://www.adobe.com/support/security/bulletins/apsb10-02.html", "refsource": "CONFIRM", "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "name": "RHSA-2010:0060", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html" }, { "name": "ADV-2010-0103", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/0103" }, { "name": "1023446", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1023446" }, { "name": "61690", "refsource": "OSVDB", "url": "http://osvdb.org/61690" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=554293", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "name": "acrobat-reader-u3d-code-execution(55551)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "name": "38215", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/38215" }, { "name": "SUSE-SA:2010:008", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "name": "TA10-013A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html" }, { "name": "37758", "refsource": "BID", "url": "http://www.securityfocus.com/bid/37758" } ] } } } }, "cveMetadata": { "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "cveId": "CVE-2009-3953", "datePublished": "2010-01-13T19:00:00", "dateReserved": "2009-11-16T00:00:00", "dateUpdated": "2024-08-07T06:45:50.938Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "cisa_known_exploited": { "cveID": "CVE-2009-3953", "cwes": "[\"CWE-119\"]", "dateAdded": "2022-06-08", "dueDate": "2022-06-22", "knownRansomwareCampaignUse": "Unknown", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953", "product": "Acrobat and Reader", "requiredAction": "Apply updates per vendor instructions.", "shortDescription": "Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.", "vendorProject": "Adobe", "vulnerabilityName": "Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability" }, "nvd": "{\"cve\":{\"id\":\"CVE-2009-3953\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2010-01-13T19:30:00.343\",\"lastModified\":\"2024-06-28T14:20:25.363\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"evaluatorImpact\":\"Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html\\r\\n\\r\\nAffected software versions:\\r\\n\\r\\nAdobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX\\r\\nAdobe Acrobat 9.2 and earlier versions for Windows and Macintosh\",\"cisaExploitAdd\":\"2022-06-08\",\"cisaActionDue\":\"2022-06-22\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \\\"array boundary issue,\\\" a different vulnerability than CVE-2009-2994.\"},{\"lang\":\"es\",\"value\":\"La implementaci\u00f3n U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podr\u00eda permitir a atacantes ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de vectores no especificados, relacionados con una \\\"cuesti\u00f3n de limitaci\u00f3n en el array\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":10.0},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"C1329474-A9CD-44C3-828C-A0D53418300B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0\",\"versionEndExcluding\":\"8.2\",\"matchCriteriaId\":\"9670133C-09FA-41F2-B0F7-BFE960E30B71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0\",\"versionEndExcluding\":\"9.3\",\"matchCriteriaId\":\"EA95CC75-BF25-4BEB-B646-ACDBBE32AF4F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4781BF1E-8A4E-4AFF-9540-23D523EE30DD\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C76D0C17-2AFF-4209-BBCD-36166DF7F974\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FBF7B6A8-3DF9-46EC-A90E-6EF68C39F883\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A3B50EE-F432-40BE-B422-698955A6058D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1193A7E6-DCB4-4E79-A509-1D6948153A57\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://osvdb.org/61690\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/38138\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/38215\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.adobe.com/support/security/bulletins/apsb10-02.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Not Applicable\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0060.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/37758\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id?1023446\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.vupen.com/english/advisories/2010/0103\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=554293\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]}]}}" } }
ghsa-q4f6-24ph-r6rm
Vulnerability from github
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
{ "affected": [], "aliases": [ "CVE-2009-3953" ], "database_specific": { "cwe_ids": [ "CWE-119" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2010-01-13T19:30:00Z", "severity": "HIGH" }, "details": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.", "id": "GHSA-q4f6-24ph-r6rm", "modified": "2022-05-02T03:50:11Z", "published": "2022-05-02T03:50:11Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "type": "WEB", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "type": "WEB", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "type": "WEB", "url": "http://osvdb.org/61690" }, { "type": "WEB", "url": "http://secunia.com/advisories/38138" }, { "type": "WEB", "url": "http://secunia.com/advisories/38215" }, { "type": "WEB", "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "type": "WEB", "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "type": "WEB", "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html" }, { "type": "WEB", "url": "http://www.securityfocus.com/bid/37758" }, { "type": "WEB", "url": "http://www.securitytracker.com/id?1023446" }, { "type": "WEB", "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html" }, { "type": "WEB", "url": "http://www.vupen.com/english/advisories/2010/0103" } ], "schema_version": "1.4.0", "severity": [] }
var-200912-0756
Vulnerability from variot
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994. CVE-2009-2994 Is a different vulnerability.by the attacker ' Array Bounds Problem ' Arbitrary code may be executed via vectors related to. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Reader and Acrobat 9.2 and prior versions. NOTE: This issue was previously covered in BID 37667 (Adobe Acrobat and Reader January 2010 Multiple Remote Vulnerabilities), but has been given its own record to better document it. An array indexing error vulnerability exists in Adobe Reader and Acrobat's 3difr.x3d when processing U3D CLOD Mesh Declaration blocks. Users tricked into opening a PDF document containing a specially crafted U3D model will trigger memory corruption, resulting in the execution of arbitrary instructions. The Adobe Reader browser plug-in is available for several web browsers and operating systems and will automatically open PDF documents on websites. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia.
For more information visit: http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com
TITLE: Adobe Reader/Acrobat Code Execution Vulnerability
SECUNIA ADVISORY ID: SA37690
VERIFY ADVISORY: http://secunia.com/advisories/37690/
DESCRIPTION: A vulnerability has been reported in Adobe Reader and Acrobat, which can be exploited by malicious people to compromise a user's system.
NOTE: This vulnerability is currently being actively exploited.
SOLUTION: Do not open untrusted PDF files.
Do not visit untrusted websites or follow untrusted links.
PROVIDED AND/OR DISCOVERED BY: Reported as a 0-day.
ORIGINAL ADVISORY: http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/acroread < 9.3.4 >= 9.3.4
Description
Multiple vulnerabilities were discovered in Adobe Reader. For further information please consult the CVE entries and the Adobe Security Bulletins referenced below.
Impact
A remote attacker might entice a user to open a specially crafted PDF file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or bypass intended sandbox restrictions, make cross-domain requests, inject arbitrary web script or HTML, or cause a Denial of Service condition.
Workaround
There is no known workaround at this time.
Resolution
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
[ 1 ] APSA10-01 http://www.adobe.com/support/security/advisories/apsa10-01.html [ 2 ] APSB10-02 http://www.adobe.com/support/security/bulletins/apsb10-02.html [ 3 ] APSB10-07 http://www.adobe.com/support/security/bulletins/apsb10-07.html [ 4 ] APSB10-09 http://www.adobe.com/support/security/bulletins/apsb10-09.html [ 5 ] APSB10-14 http://www.adobe.com/support/security/bulletins/apsb10-14.html [ 6 ] APSB10-16 http://www.adobe.com/support/security/bulletins/apsb10-16.html [ 7 ] CVE-2009-3953 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953 [ 8 ] CVE-2009-4324 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324 [ 9 ] CVE-2010-0186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186 [ 10 ] CVE-2010-0188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188 [ 11 ] CVE-2010-0190 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190 [ 12 ] CVE-2010-0191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191 [ 13 ] CVE-2010-0192 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192 [ 14 ] CVE-2010-0193 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193 [ 15 ] CVE-2010-0194 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194 [ 16 ] CVE-2010-0195 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195 [ 17 ] CVE-2010-0196 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196 [ 18 ] CVE-2010-0197 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197 [ 19 ] CVE-2010-0198 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198 [ 20 ] CVE-2010-0199 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199 [ 21 ] CVE-2010-0201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201 [ 22 ] CVE-2010-0202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202 [ 23 ] CVE-2010-0203 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203 [ 24 ] CVE-2010-0204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204 [ 25 ] CVE-2010-1241 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241 [ 26 ] CVE-2010-1285 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285 [ 27 ] CVE-2010-1295 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295 [ 28 ] CVE-2010-1297 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297 [ 29 ] CVE-2010-2168 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168 [ 30 ] CVE-2010-2201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201 [ 31 ] CVE-2010-2202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202 [ 32 ] CVE-2010-2203 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203 [ 33 ] CVE-2010-2204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204 [ 34 ] CVE-2010-2205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205 [ 35 ] CVE-2010-2206 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206 [ 36 ] CVE-2010-2207 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207 [ 37 ] CVE-2010-2208 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208 [ 38 ] CVE-2010-2209 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209 [ 39 ] CVE-2010-2210 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210 [ 40 ] CVE-2010-2211 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211 [ 41 ] CVE-2010-2212 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200912-0756", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "acrobat", "scope": "gte", "trust": 1.0, "vendor": "adobe", "version": "9.0" }, { "model": "acrobat", "scope": "lt", "trust": 1.0, "vendor": "adobe", "version": "7.1.4" }, { "model": "linux enterprise", "scope": "eq", "trust": 1.0, "vendor": "suse", "version": "10.0" }, { "model": "acrobat", "scope": "lt", "trust": 1.0, "vendor": "adobe", "version": "8.2" }, { "model": "acrobat", "scope": "gte", "trust": 1.0, "vendor": "adobe", "version": "8.0" }, { "model": "linux enterprise debuginfo", "scope": "eq", "trust": 1.0, "vendor": "suse", "version": "11" }, { "model": "opensuse", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "11.1" }, { "model": "opensuse", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "11.2" }, { "model": "acrobat", "scope": "gte", "trust": 1.0, "vendor": "adobe", "version": "7.0" }, { "model": "acrobat", "scope": "lt", "trust": 1.0, "vendor": "adobe", "version": "9.3" }, { "model": "acrobat", "scope": "eq", "trust": 0.9, "vendor": "adobe", "version": "6.0.1" }, { "model": null, "scope": null, "trust": 0.8, "vendor": "adobe", "version": null }, { "model": "adobe reader", "scope": null, "trust": 0.8, "vendor": "\u30a2\u30c9\u30d3", "version": null }, { "model": "rhel supplementary", "scope": "eq", "trust": 0.8, "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8", "version": "eus 5.4.z (server)" }, { "model": "adobe acrobat", "scope": null, "trust": 0.8, "vendor": "\u30a2\u30c9\u30d3", "version": null }, { "model": "rhel supplementary eus", "scope": "eq", "trust": 0.8, "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8", "version": "5.4.z (server)" }, { "model": "red hat enterprise linux extras", "scope": null, "trust": 0.8, "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8", "version": null }, { "model": "rhel supplementary", "scope": "eq", "trust": 0.8, "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8", "version": "5 (server)" }, { "model": "rhel desktop supplementary", "scope": null, "trust": 0.8, "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8", "version": null }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "5.0.5" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "5.0.6" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "6.0.4" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "6.0.2" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "6.0.5" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "6.0" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "5.0.10" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "6.0.3" }, { "model": "acrobat", "scope": "eq", "trust": 0.6, "vendor": "adobe", "version": "5.0" }, { "model": "linux enterprise desktop", "scope": "eq", "trust": 0.3, "vendor": "suse", "version": "11" }, { "model": "linux enterprise sp3", "scope": "eq", "trust": 0.3, "vendor": "suse", "version": "10" }, { "model": "linux enterprise sp2", "scope": "eq", "trust": 0.3, "vendor": "suse", "version": "10" }, { "model": "opensuse", "scope": "eq", "trust": 0.3, "vendor": "s u s e", "version": "11.2" }, { "model": "opensuse", "scope": "eq", "trust": 0.3, "vendor": "s u s e", "version": "11.1" }, { "model": "opensuse", "scope": "eq", "trust": 0.3, "vendor": "s u s e", "version": "11.0" }, { "model": "enterprise linux ws extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "4" }, { "model": "enterprise linux ws extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "3" }, { "model": "enterprise linux supplementary server", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "5" }, { "model": "enterprise linux extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "4" }, { "model": "enterprise linux extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "3" }, { "model": "enterprise linux es extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "4" }, { "model": "enterprise linux es extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "3" }, { "model": "enterprise linux desktop supplementary client", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "5" }, { "model": "enterprise linux as extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "4" }, { "model": "enterprise linux as extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "3" }, { "model": "desktop extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "4" }, { "model": "desktop extras", "scope": "eq", "trust": 0.3, "vendor": "redhat", "version": "3" }, { "model": "linux", "scope": null, "trust": 0.3, "vendor": "gentoo", "version": null }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.3" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.2" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.1" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.7" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.6" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.5" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.4" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.3" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.2" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.1" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "7.0.9" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "6.0.1" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.2" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.0" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1" }, { "model": "reader", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.0" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.3" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.2" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.7" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.6" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.4" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.3" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.2" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.1" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.2" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1" }, { "model": "acrobat standard", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.0" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.3" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.2" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.7" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.6" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.4" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.3" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.2" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1.1" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.2" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.1" }, { "model": "acrobat professional", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "8.0" }, { "model": "acrobat", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.1.1" }, { "model": "acrobat", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "7.0.9" }, { "model": "acrobat", "scope": "eq", "trust": 0.3, "vendor": "adobe", "version": "9.2" }, { "model": "reader", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "9.3" }, { "model": "reader", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "8.2" }, { "model": "acrobat standard", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "9.3" }, { "model": "acrobat standard", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "8.2" }, { "model": "acrobat professional", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "9.3" }, { "model": "acrobat professional", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "8.2" }, { "model": "acrobat", "scope": "ne", "trust": 0.3, "vendor": "adobe", "version": "9.3" } ], "sources": [ { "db": "CERT/CC", "id": "VU#508357" }, { "db": "BID", "id": "37758" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "CNNVD", "id": "CNNVD-201001-099" }, { "db": "NVD", "id": "CVE-2009-3953" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:unix:unix:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2009-3953" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Parvez Anwar", "sources": [ { "db": "BID", "id": "37758" }, { "db": "CNNVD", "id": "CNNVD-201001-099" } ], "trust": 0.9 }, "cve": "CVE-2009-3953", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "impactScore": 10.0, "integrityImpact": "COMPLETE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 10.0, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2009-3953", "impactScore": null, "integrityImpact": "Complete", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "VHN-41399", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 8.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2009-3953", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2009-3953", "trust": 1.8, "value": "HIGH" }, { "author": "CARNEGIE MELLON", "id": "VU#508357", "trust": 0.8, "value": "65.84" }, { "author": "CNNVD", "id": "CNNVD-201001-099", "trust": 0.6, "value": "CRITICAL" }, { "author": "VULHUB", "id": "VHN-41399", "trust": 0.1, "value": "HIGH" }, { "author": "VULMON", "id": "CVE-2009-3953", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "CERT/CC", "id": "VU#508357" }, { "db": "VULHUB", "id": "VHN-41399" }, { "db": "VULMON", "id": "CVE-2009-3953" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "CNNVD", "id": "CNNVD-201001-099" }, { "db": "NVD", "id": "CVE-2009-3953" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994. CVE-2009-2994 Is a different vulnerability.by the attacker \u0027 Array Bounds Problem \u0027 Arbitrary code may be executed via vectors related to. Failed exploit attempts will likely cause denial-of-service conditions. \nThis issue affects Reader and Acrobat 9.2 and prior versions. \nNOTE: This issue was previously covered in BID 37667 (Adobe Acrobat and Reader January 2010 Multiple Remote Vulnerabilities), but has been given its own record to better document it. An array indexing error vulnerability exists in Adobe Reader and Acrobat\u0027s 3difr.x3d when processing U3D CLOD Mesh Declaration blocks. Users tricked into opening a PDF document containing a specially crafted U3D model will trigger memory corruption, resulting in the execution of arbitrary instructions. The Adobe Reader browser plug-in is available for several web browsers and operating systems and will automatically open PDF documents on websites. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nFor more information visit:\nhttp://secunia.com/advisories/business_solutions/\n\nAlternatively request a call from a Secunia representative today to\ndiscuss how we can help you with our capabilities contact us at:\nsales@secunia.com\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe Reader/Acrobat Code Execution Vulnerability\n\nSECUNIA ADVISORY ID:\nSA37690\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/37690/\n\nDESCRIPTION:\nA vulnerability has been reported in Adobe Reader and Acrobat, which\ncan be exploited by malicious people to compromise a user\u0027s system. \n\nNOTE: This vulnerability is currently being actively exploited. \n\nSOLUTION:\nDo not open untrusted PDF files. \n\nDo not visit untrusted websites or follow untrusted links. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported as a 0-day. \n\nORIGINAL ADVISORY:\nhttp://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 app-text/acroread \u003c 9.3.4 \u003e= 9.3.4\n\nDescription\n===========\n\nMultiple vulnerabilities were discovered in Adobe Reader. For further\ninformation please consult the CVE entries and the Adobe Security\nBulletins referenced below. \n\nImpact\n======\n\nA remote attacker might entice a user to open a specially crafted PDF\nfile, possibly resulting in the execution of arbitrary code with the\nprivileges of the user running the application, or bypass intended\nsandbox restrictions, make cross-domain requests, inject arbitrary web\nscript or HTML, or cause a Denial of Service condition. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Adobe Reader users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=app-text/acroread-9.3.4\"\n\nReferences\n==========\n\n [ 1 ] APSA10-01\n http://www.adobe.com/support/security/advisories/apsa10-01.html\n [ 2 ] APSB10-02\n http://www.adobe.com/support/security/bulletins/apsb10-02.html\n [ 3 ] APSB10-07\n http://www.adobe.com/support/security/bulletins/apsb10-07.html\n [ 4 ] APSB10-09\n http://www.adobe.com/support/security/bulletins/apsb10-09.html\n [ 5 ] APSB10-14\n http://www.adobe.com/support/security/bulletins/apsb10-14.html\n [ 6 ] APSB10-16\n http://www.adobe.com/support/security/bulletins/apsb10-16.html\n [ 7 ] CVE-2009-3953\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953\n [ 8 ] CVE-2009-4324\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324\n [ 9 ] CVE-2010-0186\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186\n [ 10 ] CVE-2010-0188\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188\n [ 11 ] CVE-2010-0190\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190\n [ 12 ] CVE-2010-0191\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191\n [ 13 ] CVE-2010-0192\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192\n [ 14 ] CVE-2010-0193\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193\n [ 15 ] CVE-2010-0194\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194\n [ 16 ] CVE-2010-0195\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195\n [ 17 ] CVE-2010-0196\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196\n [ 18 ] CVE-2010-0197\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197\n [ 19 ] CVE-2010-0198\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198\n [ 20 ] CVE-2010-0199\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199\n [ 21 ] CVE-2010-0201\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201\n [ 22 ] CVE-2010-0202\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202\n [ 23 ] CVE-2010-0203\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203\n [ 24 ] CVE-2010-0204\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204\n [ 25 ] CVE-2010-1241\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241\n [ 26 ] CVE-2010-1285\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285\n [ 27 ] CVE-2010-1295\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295\n [ 28 ] CVE-2010-1297\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297\n [ 29 ] CVE-2010-2168\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168\n [ 30 ] CVE-2010-2201\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201\n [ 31 ] CVE-2010-2202\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202\n [ 32 ] CVE-2010-2203\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203\n [ 33 ] CVE-2010-2204\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204\n [ 34 ] CVE-2010-2205\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205\n [ 35 ] CVE-2010-2206\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206\n [ 36 ] CVE-2010-2207\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207\n [ 37 ] CVE-2010-2208\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208\n [ 38 ] CVE-2010-2209\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209\n [ 39 ] CVE-2010-2210\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210\n [ 40 ] CVE-2010-2211\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211\n [ 41 ] CVE-2010-2212\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201009-05.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2010 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n", "sources": [ { "db": "NVD", "id": "CVE-2009-3953" }, { "db": "CERT/CC", "id": "VU#508357" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "BID", "id": "37758" }, { "db": "VULHUB", "id": "VHN-41399" }, { "db": "VULMON", "id": "CVE-2009-3953" }, { "db": "PACKETSTORM", "id": "83870" }, { "db": "PACKETSTORM", "id": "93607" } ], "trust": 2.97 }, "exploit_availability": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "reference": "https://www.scap.org.cn/vuln/vhn-41399", "trust": 0.1, "type": "unknown" }, { "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=16622", "trust": 0.1, "type": "exploit" } ], "sources": [ { "db": "VULHUB", "id": "VHN-41399" }, { "db": "VULMON", "id": "CVE-2009-3953" } ] }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2009-3953", "trust": 3.8 }, { "db": "VUPEN", "id": "ADV-2010-0103", "trust": 2.6 }, { "db": "SECTRACK", "id": "1023446", "trust": 2.6 }, { "db": "USCERT", "id": "TA10-013A", "trust": 2.6 }, { "db": "BID", "id": "37758", "trust": 2.3 }, { "db": "OSVDB", "id": "61690", "trust": 1.2 }, { "db": "SECUNIA", "id": "38215", "trust": 1.2 }, { "db": "SECUNIA", "id": "38138", "trust": 1.2 }, { "db": "SECUNIA", "id": "37690", "trust": 0.9 }, { "db": "OSVDB", "id": "60980", "trust": 0.8 }, { "db": "CERT/CC", "id": "VU#508357", "trust": 0.8 }, { "db": "USCERT", "id": "TA15-119A", "trust": 0.8 }, { "db": "USCERT", "id": "SA10-013A", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2010-001014", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201001-099", "trust": 0.7 }, { "db": "NSFOCUS", "id": "14347", "trust": 0.6 }, { "db": "CERT/CC", "id": "TA10-013A", "trust": 0.6 }, { "db": "SUSE", "id": "SUSE-SA:2010:008", "trust": 0.6 }, { "db": "EXPLOIT-DB", "id": "16622", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "93607", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-41399", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2009-3953", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "83870", "trust": 0.1 } ], "sources": [ { "db": "CERT/CC", "id": "VU#508357" }, { "db": "VULHUB", "id": "VHN-41399" }, { "db": "VULMON", "id": "CVE-2009-3953" }, { "db": "BID", "id": "37758" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "PACKETSTORM", "id": "83870" }, { "db": "PACKETSTORM", "id": "93607" }, { "db": "CNNVD", "id": "CNNVD-201001-099" }, { "db": "NVD", "id": "CVE-2009-3953" } ] }, "id": "VAR-200912-0756", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-41399" } ], "trust": 0.01 }, "last_update_date": "2024-07-23T21:40:51.958000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "TA10-013A", "trust": 0.8, "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "title": "Adobe Acrobat 9.3.1 Pro and Standard update - multiple languages", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4049" }, { "title": "Adobe Reader 8.1.7", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4048" }, { "title": "Adobe Acrobat 9.3.1 Pro update - multiple languages", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4052" }, { "title": "Adobe Reader 9.3", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4047" }, { "title": "Adobe Acrobat 3D 8.2.1 update - multiple languages", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4051" }, { "title": "Adobe Reader 9.3", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4046" }, { "title": "Adobe Acrobat 9.3.1 Pro Extended update - multiple languages", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4050" }, { "title": "Red Hat: Critical: acroread security and bug fix update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20100037 - security advisory" }, { "title": "Red Hat: Critical: acroread security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20100060 - security advisory" }, { "title": "Red Hat: Critical: acroread security update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20100038 - security advisory" }, { "title": "Known Exploited Vulnerabilities Detector", "trust": 0.1, "url": "https://github.com/ostorlab/kev " } ], "sources": [ { "db": "VULMON", "id": "CVE-2009-3953" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "CNNVD", "id": "CNNVD-201001-099" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-787", "trust": 1.0 }, { "problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]", "trust": 0.8 }, { "problemtype": "CWE-119", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-41399" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "NVD", "id": "CVE-2009-3953" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.6, "url": "http://www.us-cert.gov/cas/techalerts/ta10-013a.html" }, { "trust": 2.6, "url": "http://www.securitytracker.com/id?1023446" }, { "trust": 2.6, "url": "http://www.vupen.com/english/advisories/2010/0103" }, { "trust": 2.2, "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "trust": 2.1, "url": "http://www.securityfocus.com/bid/37758" }, { "trust": 1.8, "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "trust": 1.7, "url": "http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html" }, { "trust": 1.2, "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "trust": 1.2, "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "trust": 1.2, "url": "http://osvdb.org/61690" }, { "trust": 1.2, "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a8242" }, { "trust": 1.2, "url": "http://www.redhat.com/support/errata/rhsa-2010-0060.html" }, { "trust": 1.2, "url": "http://secunia.com/advisories/38138" }, { "trust": 1.2, "url": "http://secunia.com/advisories/38215" }, { "trust": 1.2, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "trust": 0.9, "url": "http://secunia.com/advisories/37690/" }, { "trust": 0.8, "url": "http://www.adobe.com/support/security/advisories/apsa09-07.html" }, { "trust": 0.8, "url": "http://kb2.adobe.com/cps/532/cpsid_53237.html" }, { "trust": 0.8, "url": "http://osvdb.org/show/osvdb/60980" }, { "trust": 0.8, "url": "http://www.symantec.com/connect/blogs/zero-day-xmas-present" }, { "trust": 0.8, "url": "http://voices.washingtonpost.com/securityfix/2009/12/hackers_target_unpatched_adobe.html" }, { "trust": 0.8, "url": "http://vrt-sourcefire.blogspot.com/2009/12/this-is-what-happens-when-you-try-to-do.html" }, { "trust": 0.8, "url": "http://jvn.jp/cert/jvnta10-013a/" }, { "trust": 0.8, "url": "http://jvn.jp/ta/jvnta99041988/" }, { "trust": 0.8, "url": "http://jvn.jp/tr/jvntr-2010-03/" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-3953" }, { "trust": 0.8, "url": "http://www.jpcert.or.jp/at/2010/at100003.txt" }, { "trust": 0.8, "url": "http://www.npa.go.jp/cyberpolice/index.html#topics" }, { "trust": 0.8, "url": "http://www.us-cert.gov/cas/alerts/sa10-013a.html" }, { "trust": 0.8, "url": "https://www.us-cert.gov/ncas/alerts/ta15-119a" }, { "trust": 0.8, "url": "https://cisa.gov/known-exploited-vulnerabilities-catalog" }, { "trust": 0.8, "url": "http://www.ipa.go.jp/security/ciadr/vul/20100113-adobe.html" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/14347" }, { "trust": 0.3, "url": "http://www.adobe.com" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/119.html" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2010:0037" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://www.exploit-db.com/exploits/16622/" }, { "trust": 0.1, "url": "https://www.rapid7.com/db/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "trust": 0.1, "url": "http://secunia.com/advisories/secunia_security_advisories/" }, { "trust": 0.1, "url": "http://secunia.com/advisories/business_solutions/" }, { "trust": 0.1, "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org" }, { "trust": 0.1, "url": "http://secunia.com/advisories/about_secunia_advisories/" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2203" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2009-4324" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2209" }, { "trust": 0.1, "url": "https://bugs.gentoo.org." }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0188" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0194" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0202" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0194" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0199" }, { "trust": 0.1, "url": "http://security.gentoo.org/glsa/glsa-201009-05.xml" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2202" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2205" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2206" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0203" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0197" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2211" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1285" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2204" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0199" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0192" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0186" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0190" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0196" }, { "trust": 0.1, "url": "http://www.adobe.com/support/security/bulletins/apsb10-14.html" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3953" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4324" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0191" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0202" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0204" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0201" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2210" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0197" }, { "trust": 0.1, "url": "http://creativecommons.org/licenses/by-sa/2.5" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0188" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0198" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0191" }, { "trust": 0.1, "url": "http://www.adobe.com/support/security/bulletins/apsb10-07.html" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1297" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1241" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1295" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0192" }, { "trust": 0.1, "url": "http://security.gentoo.org/" }, { "trust": 0.1, "url": "http://www.adobe.com/support/security/advisories/apsa10-01.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3953" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0203" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2208" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0190" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0193" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0198" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2207" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0195" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0204" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2168" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0201" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0196" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2201" }, { "trust": 0.1, "url": "http://www.adobe.com/support/security/bulletins/apsb10-09.html" }, { "trust": 0.1, "url": "http://www.adobe.com/support/security/bulletins/apsb10-16.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0193" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0186" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0195" }, { "trust": 0.1, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2212" } ], "sources": [ { "db": "CERT/CC", "id": "VU#508357" }, { "db": "VULHUB", "id": "VHN-41399" }, { "db": "VULMON", "id": "CVE-2009-3953" }, { "db": "BID", "id": "37758" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "PACKETSTORM", "id": "83870" }, { "db": "PACKETSTORM", "id": "93607" }, { "db": "CNNVD", "id": "CNNVD-201001-099" }, { "db": "NVD", "id": "CVE-2009-3953" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CERT/CC", "id": "VU#508357" }, { "db": "VULHUB", "id": "VHN-41399" }, { "db": "VULMON", "id": "CVE-2009-3953" }, { "db": "BID", "id": "37758" }, { "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "db": "PACKETSTORM", "id": "83870" }, { "db": "PACKETSTORM", "id": "93607" }, { "db": "CNNVD", "id": "CNNVD-201001-099" }, { "db": "NVD", "id": "CVE-2009-3953" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2009-12-15T00:00:00", "db": "CERT/CC", "id": "VU#508357" }, { "date": "2010-01-13T00:00:00", "db": "VULHUB", "id": "VHN-41399" }, { "date": "2010-01-13T00:00:00", "db": "VULMON", "id": "CVE-2009-3953" }, { "date": "2010-01-12T00:00:00", "db": "BID", "id": "37758" }, { "date": "2010-02-10T00:00:00", "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "date": "2009-12-15T13:39:57", "db": "PACKETSTORM", "id": "83870" }, { "date": "2010-09-08T05:23:46", "db": "PACKETSTORM", "id": "93607" }, { "date": "2010-01-13T00:00:00", "db": "CNNVD", "id": "CNNVD-201001-099" }, { "date": "2010-01-13T19:30:00.343000", "db": "NVD", "id": "CVE-2009-3953" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2010-06-18T00:00:00", "db": "CERT/CC", "id": "VU#508357" }, { "date": "2018-10-30T00:00:00", "db": "VULHUB", "id": "VHN-41399" }, { "date": "2018-10-30T00:00:00", "db": "VULMON", "id": "CVE-2009-3953" }, { "date": "2010-09-07T21:12:00", "db": "BID", "id": "37758" }, { "date": "2024-07-02T02:14:00", "db": "JVNDB", "id": "JVNDB-2010-001014" }, { "date": "2011-07-13T00:00:00", "db": "CNNVD", "id": "CNNVD-201001-099" }, { "date": "2024-06-28T14:20:25.363000", "db": "NVD", "id": "CVE-2009-3953" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201001-099" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Adobe Acrobat and Reader contain a use-after-free vulnerability in the JavaScript Doc.media.newPlayer method", "sources": [ { "db": "CERT/CC", "id": "VU#508357" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer overflow", "sources": [ { "db": "CNNVD", "id": "CNNVD-201001-099" } ], "trust": 0.6 } }
gsd-2009-3953
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2009-3953", "description": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.", "id": "GSD-2009-3953", "references": [ "https://www.suse.com/security/cve/CVE-2009-3953.html", "https://access.redhat.com/errata/RHSA-2010:0060", "https://access.redhat.com/errata/RHSA-2010:0038", "https://access.redhat.com/errata/RHSA-2010:0037" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2009-3953" ], "details": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.", "id": "GSD-2009-3953", "modified": "2023-12-13T01:19:48.871607Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "psirt@adobe.com", "ID": "CVE-2009-3953", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl", "refsource": "MISC", "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "name": "38138", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/38138" }, { "name": "oval:org.mitre.oval:def:8242", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242" }, { "name": "http://www.adobe.com/support/security/bulletins/apsb10-02.html", "refsource": "CONFIRM", "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "name": "RHSA-2010:0060", "refsource": "REDHAT", "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html" }, { "name": "ADV-2010-0103", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/0103" }, { "name": "1023446", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1023446" }, { "name": "61690", "refsource": "OSVDB", "url": "http://osvdb.org/61690" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=554293", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "name": "acrobat-reader-u3d-code-execution(55551)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "name": "38215", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/38215" }, { "name": "SUSE-SA:2010:008", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "name": "TA10-013A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html" }, { "name": "37758", "refsource": "BID", "url": "http://www.securityfocus.com/bid/37758" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:unix:unix:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "psirt@adobe.com", "ID": "CVE-2009-3953" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-119" } ] } ] }, "references": { "reference_data": [ { "name": "http://www.adobe.com/support/security/bulletins/apsb10-02.html", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "name": "TA10-013A", "refsource": "CERT", "tags": [ "US Government Resource" ], "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html" }, { "name": "ADV-2010-0103", "refsource": "VUPEN", "tags": [ "Vendor Advisory" ], "url": "http://www.vupen.com/english/advisories/2010/0103" }, { "name": "1023446", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id?1023446" }, { "name": "SUSE-SA:2010:008", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html" }, { "name": "61690", "refsource": "OSVDB", "tags": [], "url": "http://osvdb.org/61690" }, { "name": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl", "refsource": "MISC", "tags": [], "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl" }, { "name": "38138", "refsource": "SECUNIA", "tags": [], "url": "http://secunia.com/advisories/38138" }, { "name": "37758", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/37758" }, { "name": "RHSA-2010:0060", "refsource": "REDHAT", "tags": [], "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=554293", "refsource": "CONFIRM", "tags": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "name": "38215", "refsource": "SECUNIA", "tags": [], "url": "http://secunia.com/advisories/38215" }, { "name": "acrobat-reader-u3d-code-execution(55551)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551" }, { "name": "oval:org.mitre.oval:def:8242", "refsource": "OVAL", "tags": [], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false } }, "lastModifiedDate": "2018-10-30T16:25Z", "publishedDate": "2010-01-13T19:30Z" } } }
rhsa-2010_0060
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "The acroread packages as shipped in Red Hat Enterprise Linux 3 Extras\ncontain security flaws and should not be used.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.", "title": "Topic" }, { "category": "general", "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nAdobe Reader 8.1.7 is vulnerable to critical security flaws and should no\nlonger be used. A specially-crafted PDF file could cause Adobe Reader to\ncrash or, potentially, execute arbitrary code as the user running Adobe\nReader when opened. (CVE-2009-4324, CVE-2009-3953, CVE-2009-3954,\nCVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. Adobe Reader\n9 for Linux is not compatible with Red Hat Enterprise Linux 3. An\nalternative PDF file viewer available in Red Hat Enterprise Linux 3 is\nxpdf.\n\nThis update removes the acroread packages due to their known security\nvulnerabilities.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2010:0060", "url": "https://access.redhat.com/errata/RHSA-2010:0060" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html", "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "category": "external", "summary": "547799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799" }, { "category": "external", "summary": "554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "554296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0060.json" } ], "title": "Red Hat Security Advisory: acroread security update", "tracking": { "current_release_date": "2024-11-14T10:47:51+00:00", "generator": { "date": "2024-11-14T10:47:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.0" } }, "id": "RHSA-2010:0060", "initial_release_date": "2010-01-20T14:38:00+00:00", "revision_history": [ { "date": "2010-01-20T14:38:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2010-01-20T09:38:14+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T10:47:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AS version 3 Extras", "product": { "name": "Red Hat Enterprise Linux AS version 3 Extras", "product_id": "3AS-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:3" } } }, { "category": "product_name", "name": "Red Hat Desktop version 3 Extras", "product": { "name": "Red Hat Desktop version 3 Extras", "product_id": "3Desktop-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:3" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ES version 3 Extras", "product": { "name": "Red Hat Enterprise Linux ES version 3 Extras", "product_id": "3ES-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:3" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux WS version 3 Extras", "product": { "name": "Red Hat Enterprise Linux WS version 3 Extras", "product_id": "3WS-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:3" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "acroread-uninstall-0:9.3-3.i386", "product": { "name": "acroread-uninstall-0:9.3-3.i386", "product_id": "acroread-uninstall-0:9.3-3.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/acroread-uninstall@9.3-3?arch=i386" } } } ], "category": "architecture", "name": "i386" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux AS version 3 Extras", "product_id": "3AS-LACD:acroread-uninstall-0:9.3-3.i386" }, "product_reference": "acroread-uninstall-0:9.3-3.i386", "relates_to_product_reference": "3AS-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Desktop version 3 Extras", "product_id": "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386" }, "product_reference": "acroread-uninstall-0:9.3-3.i386", "relates_to_product_reference": "3Desktop-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux ES version 3 Extras", "product_id": "3ES-LACD:acroread-uninstall-0:9.3-3.i386" }, "product_reference": "acroread-uninstall-0:9.3-3.i386", "relates_to_product_reference": "3ES-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux WS version 3 Extras", "product_id": "3WS-LACD:acroread-uninstall-0:9.3-3.i386" }, "product_reference": "acroread-uninstall-0:9.3-3.i386", "relates_to_product_reference": "3WS-LACD" } ] }, "vulnerabilities": [ { "cve": "CVE-2009-3953", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3953" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-20T14:38:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0060" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-06-08T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3954", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3954" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-20T14:38:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0060" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3955", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3955" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-20T14:38:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0060" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3956", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554296" } ], "notes": [ { "category": "description", "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: script injection vulnerability (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3956" }, { "category": "external", "summary": "RHBZ#554296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-20T14:38:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0060" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "acroread: script injection vulnerability (APSB10-02)" }, { "cve": "CVE-2009-3959", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3959" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-20T14:38:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0060" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-4324", "discovery_date": "2009-12-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "547799" } ], "notes": [ { "category": "description", "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-4324" }, { "category": "external", "summary": "RHBZ#547799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324", "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2009-12-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-20T14:38:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0060" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "3AS-LACD:acroread-uninstall-0:9.3-3.i386", "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386", "3ES-LACD:acroread-uninstall-0:9.3-3.i386", "3WS-LACD:acroread-uninstall-0:9.3-3.i386" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-06-08T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Critical" } ], "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)" } ] }
rhsa-2010_0037
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated acroread packages that fix multiple security issues and three bugs\nare now available for Red Hat Enterprise Linux 5 Supplementary.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.", "title": "Topic" }, { "category": "general", "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nThis update fixes several vulnerabilities in Adobe Reader. These\nvulnerabilities are summarized on the Adobe Security Advisory APSB10-02\npage listed in the References section. A specially-crafted PDF file could\ncause Adobe Reader to crash or, potentially, execute arbitrary code as the\nuser running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953,\nCVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nThis update also fixes the following bugs:\n\n* the acroread process continued to run even after closing a PDF file. If\nmultiple PDF files were opened and then closed, the acroread processes\ncontinued to run and consume system resources (up to 100% CPU usage). With\nthis update, the acroread process correctly exits, which resolves this\nissue. (BZ#473217)\n\n* the PPKLite.api plug-in was missing, causing Adobe Reader to crash when\nattempting to open signed PDF files. For such files, if an immediate crash\nwas not observed, clicking on the Signature Panel could trigger one. With\nthis update, the PPKLite.api plug-in is included, which resolves this\nissue. (BZ#472975)\n\n* Adobe Reader has been upgraded to version 9.3. (BZ#497957)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. All users of\nAdobe Reader are advised to install these updated packages, which contain\nAdobe Reader version 9.3, which is not vulnerable to these issues and fixes\nthese bugs. All running instances of Adobe Reader must be restarted for the\nupdate to take effect.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2010:0037", "url": "https://access.redhat.com/errata/RHSA-2010:0037" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html", "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "category": "external", "summary": "472975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=472975" }, { "category": "external", "summary": "473217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=473217" }, { "category": "external", "summary": "547799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799" }, { "category": "external", "summary": "554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "554296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0037.json" } ], "title": "Red Hat Security Advisory: acroread security and bug fix update", "tracking": { "current_release_date": "2024-11-14T10:47:38+00:00", "generator": { "date": "2024-11-14T10:47:38+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.0" } }, "id": "RHSA-2010:0037", "initial_release_date": "2010-01-13T16:03:00+00:00", "revision_history": [ { "date": "2010-01-13T16:03:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2010-01-13T11:03:38+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T10:47:38+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)", "product_id": "5Client-Supplementary", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:5::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 5)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 5)", "product_id": "5Server-Supplementary", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:5::server" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "acroread-plugin-0:9.3-1.el5.i386", "product": { "name": "acroread-plugin-0:9.3-1.el5.i386", "product_id": "acroread-plugin-0:9.3-1.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/acroread-plugin@9.3-1.el5?arch=i386" } } }, { "category": "product_version", "name": "acroread-0:9.3-1.el5.i386", "product": { "name": "acroread-0:9.3-1.el5.i386", "product_id": "acroread-0:9.3-1.el5.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/acroread@9.3-1.el5?arch=i386" } } } ], "category": "architecture", "name": "i386" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "acroread-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)", "product_id": "5Client-Supplementary:acroread-0:9.3-1.el5.i386" }, "product_reference": "acroread-0:9.3-1.el5.i386", "relates_to_product_reference": "5Client-Supplementary" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-plugin-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)", "product_id": "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386" }, "product_reference": "acroread-plugin-0:9.3-1.el5.i386", "relates_to_product_reference": "5Client-Supplementary" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)", "product_id": "5Server-Supplementary:acroread-0:9.3-1.el5.i386" }, "product_reference": "acroread-0:9.3-1.el5.i386", "relates_to_product_reference": "5Server-Supplementary" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-plugin-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)", "product_id": "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" }, "product_reference": "acroread-plugin-0:9.3-1.el5.i386", "relates_to_product_reference": "5Server-Supplementary" } ] }, "vulnerabilities": [ { "cve": "CVE-2009-3953", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3953" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:03:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0037" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-06-08T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3954", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3954" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:03:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0037" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3955", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3955" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:03:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0037" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3956", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554296" } ], "notes": [ { "category": "description", "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: script injection vulnerability (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3956" }, { "category": "external", "summary": "RHBZ#554296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:03:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0037" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "acroread: script injection vulnerability (APSB10-02)" }, { "cve": "CVE-2009-3959", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3959" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:03:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0037" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-4324", "discovery_date": "2009-12-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "547799" } ], "notes": [ { "category": "description", "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-4324" }, { "category": "external", "summary": "RHBZ#547799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324", "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2009-12-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:03:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0037" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "5Client-Supplementary:acroread-0:9.3-1.el5.i386", "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-0:9.3-1.el5.i386", "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-06-08T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Critical" } ], "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)" } ] }
rhsa-2010_0038
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated acroread packages that fix multiple security issues are now\navailable for Red Hat Enterprise Linux 4 Extras.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.", "title": "Topic" }, { "category": "general", "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nThis update fixes several vulnerabilities in Adobe Reader. These\nvulnerabilities are summarized on the Adobe Security Advisory APSB10-02\npage listed in the References section. A specially-crafted PDF file could\ncause Adobe Reader to crash or, potentially, execute arbitrary code as the\nuser running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953,\nCVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. All users of\nAdobe Reader are advised to install these updated packages, which contain\nAdobe Reader version 9.3, which is not vulnerable to these issues. All\nrunning instances of Adobe Reader must be restarted for the update to take\neffect.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2010:0038", "url": "https://access.redhat.com/errata/RHSA-2010:0038" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html", "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html" }, { "category": "external", "summary": "547799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799" }, { "category": "external", "summary": "554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "554296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0038.json" } ], "title": "Red Hat Security Advisory: acroread security update", "tracking": { "current_release_date": "2024-11-14T10:47:42+00:00", "generator": { "date": "2024-11-14T10:47:42+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.0" } }, "id": "RHSA-2010:0038", "initial_release_date": "2010-01-13T16:08:00+00:00", "revision_history": [ { "date": "2010-01-13T16:08:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2010-01-13T11:08:18+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T10:47:42+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AS version 4 Extras", "product": { "name": "Red Hat Enterprise Linux AS version 4 Extras", "product_id": "4AS-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:4" } } }, { "category": "product_name", "name": "Red Hat Desktop version 4 Extras", "product": { "name": "Red Hat Desktop version 4 Extras", "product_id": "4Desktop-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:4" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ES version 4 Extras", "product": { "name": "Red Hat Enterprise Linux ES version 4 Extras", "product_id": "4ES-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:4" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux WS version 4 Extras", "product": { "name": "Red Hat Enterprise Linux WS version 4 Extras", "product_id": "4WS-LACD", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:4" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "acroread-plugin-0:9.3-1.el4.i386", "product": { "name": "acroread-plugin-0:9.3-1.el4.i386", "product_id": "acroread-plugin-0:9.3-1.el4.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/acroread-plugin@9.3-1.el4?arch=i386" } } }, { "category": "product_version", "name": "acroread-0:9.3-1.el4.i386", "product": { "name": "acroread-0:9.3-1.el4.i386", "product_id": "acroread-0:9.3-1.el4.i386", "product_identification_helper": { "purl": "pkg:rpm/redhat/acroread@9.3-1.el4?arch=i386" } } } ], "category": "architecture", "name": "i386" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras", "product_id": "4AS-LACD:acroread-0:9.3-1.el4.i386" }, "product_reference": "acroread-0:9.3-1.el4.i386", "relates_to_product_reference": "4AS-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras", "product_id": "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386" }, "product_reference": "acroread-plugin-0:9.3-1.el4.i386", "relates_to_product_reference": "4AS-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Desktop version 4 Extras", "product_id": "4Desktop-LACD:acroread-0:9.3-1.el4.i386" }, "product_reference": "acroread-0:9.3-1.el4.i386", "relates_to_product_reference": "4Desktop-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Desktop version 4 Extras", "product_id": "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386" }, "product_reference": "acroread-plugin-0:9.3-1.el4.i386", "relates_to_product_reference": "4Desktop-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras", "product_id": "4ES-LACD:acroread-0:9.3-1.el4.i386" }, "product_reference": "acroread-0:9.3-1.el4.i386", "relates_to_product_reference": "4ES-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras", "product_id": "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386" }, "product_reference": "acroread-plugin-0:9.3-1.el4.i386", "relates_to_product_reference": "4ES-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras", "product_id": "4WS-LACD:acroread-0:9.3-1.el4.i386" }, "product_reference": "acroread-0:9.3-1.el4.i386", "relates_to_product_reference": "4WS-LACD" }, { "category": "default_component_of", "full_product_name": { "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras", "product_id": "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" }, "product_reference": "acroread-plugin-0:9.3-1.el4.i386", "relates_to_product_reference": "4WS-LACD" } ] }, "vulnerabilities": [ { "cve": "CVE-2009-3953", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3953" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:08:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0038" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-06-08T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3954", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3954" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:08:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0038" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3955", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3955" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:08:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0038" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-3956", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554296" } ], "notes": [ { "category": "description", "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: script injection vulnerability (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3956" }, { "category": "external", "summary": "RHBZ#554296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:08:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0038" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "acroread: script injection vulnerability (APSB10-02)" }, { "cve": "CVE-2009-3959", "discovery_date": "2010-01-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "554293" } ], "notes": [ { "category": "description", "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: multiple code execution flaws (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-3959" }, { "category": "external", "summary": "RHBZ#554293", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959", "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959" } ], "release_date": "2010-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:08:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0038" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "acroread: multiple code execution flaws (APSB10-02)" }, { "cve": "CVE-2009-4324", "discovery_date": "2009-12-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "547799" } ], "notes": [ { "category": "description", "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.", "title": "Vulnerability description" }, { "category": "summary", "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2009-4324" }, { "category": "external", "summary": "RHBZ#547799", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324", "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324", "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2009-12-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2010-01-13T16:08:00+00:00", "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", "product_ids": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2010:0038" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "4AS-LACD:acroread-0:9.3-1.el4.i386", "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-0:9.3-1.el4.i386", "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386", "4ES-LACD:acroread-0:9.3-1.el4.i386", "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386", "4WS-LACD:acroread-0:9.3-1.el4.i386", "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-06-08T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Critical" } ], "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.