CVE-2009-3953 (GCVE-0-2009-3953)

Vulnerability from cvelistv5 – Published: 2010-01-13 19:00 – Updated: 2025-10-22 00:05

CISA

Summary

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Assigner

adobe

References

URL

Tags

	http://www.metasploit.com/modules/exploit/windows…	x_refsource_MISC
	http://secunia.com/advisories/38138	third-party-advisoryx_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
	http://www.adobe.com/support/security/bulletins/a…	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2010-00…	vendor-advisoryx_refsource_REDHAT
	http://www.vupen.com/english/advisories/2010/0103	vdb-entryx_refsource_VUPEN
	http://www.securitytracker.com/id?1023446	vdb-entryx_refsource_SECTRACK
	http://osvdb.org/61690	vdb-entryx_refsource_OSVDB
	https://bugzilla.redhat.com/show_bug.cgi?id=554293	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://secunia.com/advisories/38215	third-party-advisoryx_refsource_SECUNIA
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
	http://www.us-cert.gov/cas/techalerts/TA10-013A.html	third-party-advisoryx_refsource_CERT
	http://www.securityfocus.com/bid/37758	vdb-entryx_refsource_BID

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2022-06-08

Due date: 2022-06-22

Required action: Apply updates per vendor instructions.

Used in ransomware: Unknown

Notes: https://nvd.nist.gov/vuln/detail/CVE-2009-3953

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T06:45:50.938Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
          },
          {
            "name": "38138",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38138"
          },
          {
            "name": "oval:org.mitre.oval:def:8242",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
          },
          {
            "name": "RHSA-2010:0060",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
          },
          {
            "name": "ADV-2010-0103",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/0103"
          },
          {
            "name": "1023446",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1023446"
          },
          {
            "name": "61690",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/61690"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
          },
          {
            "name": "acrobat-reader-u3d-code-execution(55551)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
          },
          {
            "name": "38215",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/38215"
          },
          {
            "name": "SUSE-SA:2010:008",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
          },
          {
            "name": "TA10-013A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
          },
          {
            "name": "37758",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/37758"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2009-3953",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T21:43:54.138266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-06-08",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-22T00:05:53.712Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-06-08T00:00:00+00:00",
            "value": "CVE-2009-3953 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-01-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
        },
        {
          "name": "38138",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38138"
        },
        {
          "name": "oval:org.mitre.oval:def:8242",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
        },
        {
          "name": "RHSA-2010:0060",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
        },
        {
          "name": "ADV-2010-0103",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/0103"
        },
        {
          "name": "1023446",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1023446"
        },
        {
          "name": "61690",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/61690"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "name": "acrobat-reader-u3d-code-execution(55551)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
        },
        {
          "name": "38215",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/38215"
        },
        {
          "name": "SUSE-SA:2010:008",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
        },
        {
          "name": "TA10-013A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
        },
        {
          "name": "37758",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/37758"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2009-3953",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl",
              "refsource": "MISC",
              "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
            },
            {
              "name": "38138",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38138"
            },
            {
              "name": "oval:org.mitre.oval:def:8242",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
            },
            {
              "name": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
              "refsource": "CONFIRM",
              "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
            },
            {
              "name": "RHSA-2010:0060",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
            },
            {
              "name": "ADV-2010-0103",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/0103"
            },
            {
              "name": "1023446",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1023446"
            },
            {
              "name": "61690",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/61690"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=554293",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
            },
            {
              "name": "acrobat-reader-u3d-code-execution(55551)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
            },
            {
              "name": "38215",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/38215"
            },
            {
              "name": "SUSE-SA:2010:008",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
            },
            {
              "name": "TA10-013A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
            },
            {
              "name": "37758",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/37758"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2009-3953",
    "datePublished": "2010-01-13T19:00:00.000Z",
    "dateReserved": "2009-11-16T00:00:00.000Z",
    "dateUpdated": "2025-10-22T00:05:53.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2009-3953",
      "cwes": "[\"CWE-119\"]",
      "dateAdded": "2022-06-08",
      "dueDate": "2022-06-22",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
      "product": "Acrobat and Reader",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.",
      "vendorProject": "Adobe",
      "vulnerabilityName": "Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability"
    },
    "fkie_nvd": {
      "cisaActionDue": "2022-06-22",
      "cisaExploitAdd": "2022-06-08",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability",
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0\", \"versionEndExcluding\": \"7.1.4\", \"matchCriteriaId\": \"C1329474-A9CD-44C3-828C-A0D53418300B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0\", \"versionEndExcluding\": \"8.2\", \"matchCriteriaId\": \"9670133C-09FA-41F2-B0F7-BFE960E30B71\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"9.0\", \"versionEndExcluding\": \"9.3\", \"matchCriteriaId\": \"EA95CC75-BF25-4BEB-B646-ACDBBE32AF4F\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4781BF1E-8A4E-4AFF-9540-23D523EE30DD\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"C76D0C17-2AFF-4209-BBCD-36166DF7F974\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FBF7B6A8-3DF9-46EC-A90E-6EF68C39F883\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*\", \"matchCriteriaId\": \"6A3B50EE-F432-40BE-B422-698955A6058D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*\", \"matchCriteriaId\": \"1193A7E6-DCB4-4E79-A509-1D6948153A57\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \\\"array boundary issue,\\\" a different vulnerability than CVE-2009-2994.\"}, {\"lang\": \"es\", \"value\": \"La implementaci\\u00f3n  U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podr\\u00eda permitir a atacantes ejecutar c\\u00f3digo de su elecci\\u00f3n a trav\\u00e9s de vectores no especificados, relacionados con una \\\"cuesti\\u00f3n de limitaci\\u00f3n en el array\\\".\"}]",
      "evaluatorImpact": "Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html\r\n\r\nAffected software versions:\r\n\r\nAdobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX\r\nAdobe Acrobat 9.2 and earlier versions for Windows and Macintosh",
      "id": "CVE-2009-3953",
      "lastModified": "2024-12-19T18:08:14.627",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2010-01-13T19:30:00.343",
      "references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://osvdb.org/61690\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://secunia.com/advisories/38138\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://secunia.com/advisories/38215\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-02.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Not Applicable\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0060.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securityfocus.com/bid/37758\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id?1023446\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2010/0103\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=554293\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://osvdb.org/61690\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://secunia.com/advisories/38138\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://secunia.com/advisories/38215\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-02.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\", \"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0060.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.securityfocus.com/bid/37758\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id?1023446\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2010/0103\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=554293\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}]",
      "sourceIdentifier": "psirt@adobe.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-3953\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2010-01-13T19:30:00.343\",\"lastModified\":\"2025-10-22T01:15:34.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \\\"array boundary issue,\\\" a different vulnerability than CVE-2009-2994.\"},{\"lang\":\"es\",\"value\":\"La implementaci\u00f3n  U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podr\u00eda permitir a atacantes ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de vectores no especificados, relacionados con una \\\"cuesti\u00f3n de limitaci\u00f3n en el array\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2022-06-08\",\"cisaActionDue\":\"2022-06-22\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"C1329474-A9CD-44C3-828C-A0D53418300B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0\",\"versionEndExcluding\":\"8.2\",\"matchCriteriaId\":\"9670133C-09FA-41F2-B0F7-BFE960E30B71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0\",\"versionEndExcluding\":\"9.3\",\"matchCriteriaId\":\"EA95CC75-BF25-4BEB-B646-ACDBBE32AF4F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4781BF1E-8A4E-4AFF-9540-23D523EE30DD\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C76D0C17-2AFF-4209-BBCD-36166DF7F974\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FBF7B6A8-3DF9-46EC-A90E-6EF68C39F883\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A3B50EE-F432-40BE-B422-698955A6058D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1193A7E6-DCB4-4E79-A509-1D6948153A57\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://osvdb.org/61690\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/38138\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/38215\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.adobe.com/support/security/bulletins/apsb10-02.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Not Applicable\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0060.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/37758\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id?1023446\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.vupen.com/english/advisories/2010/0103\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=554293\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://osvdb.org/61690\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/38138\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://secunia.com/advisories/38215\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.adobe.com/support/security/bulletins/apsb10-02.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0060.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.securityfocus.com/bid/37758\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id?1023446\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"http://www.vupen.com/english/advisories/2010/0103\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=554293\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}],\"evaluatorImpact\":\"Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html\\r\\n\\r\\nAffected software versions:\\r\\n\\r\\nAdobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX\\r\\nAdobe Acrobat 9.2 and earlier versions for Windows and Macintosh\"}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://secunia.com/advisories/38138\", \"name\": \"38138\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\", \"x_transferred\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\", \"name\": \"oval:org.mitre.oval:def:8242\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\", \"x_transferred\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-02.html\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0060.html\", \"name\": \"RHSA-2010:0060\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2010/0103\", \"name\": \"ADV-2010-0103\", \"tags\": [\"vdb-entry\", \"x_refsource_VUPEN\", \"x_transferred\"]}, {\"url\": \"http://www.securitytracker.com/id?1023446\", \"name\": \"1023446\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"]}, {\"url\": \"http://osvdb.org/61690\", \"name\": \"61690\", \"tags\": [\"vdb-entry\", \"x_refsource_OSVDB\", \"x_transferred\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=554293\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\", \"name\": \"acrobat-reader-u3d-code-execution(55551)\", \"tags\": [\"vdb-entry\", \"x_refsource_XF\", \"x_transferred\"]}, {\"url\": \"http://secunia.com/advisories/38215\", \"name\": \"38215\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\", \"x_transferred\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\", \"name\": \"SUSE-SA:2010:008\", \"tags\": [\"vendor-advisory\", \"x_refsource_SUSE\", \"x_transferred\"]}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\", \"name\": \"TA10-013A\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/37758\", \"name\": \"37758\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-07T06:45:50.938Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2009-3953\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T21:43:54.138266Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2022-06-08\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-06-08T00:00:00+00:00\", \"value\": \"CVE-2009-3953 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T21:44:08.794Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2010-01-12T00:00:00.000Z\", \"references\": [{\"url\": \"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://secunia.com/advisories/38138\", \"name\": \"38138\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\", \"name\": \"oval:org.mitre.oval:def:8242\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-02.html\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0060.html\", \"name\": \"RHSA-2010:0060\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2010/0103\", \"name\": \"ADV-2010-0103\", \"tags\": [\"vdb-entry\", \"x_refsource_VUPEN\"]}, {\"url\": \"http://www.securitytracker.com/id?1023446\", \"name\": \"1023446\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"]}, {\"url\": \"http://osvdb.org/61690\", \"name\": \"61690\", \"tags\": [\"vdb-entry\", \"x_refsource_OSVDB\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=554293\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\", \"name\": \"acrobat-reader-u3d-code-execution(55551)\", \"tags\": [\"vdb-entry\", \"x_refsource_XF\"]}, {\"url\": \"http://secunia.com/advisories/38215\", \"name\": \"38215\", \"tags\": [\"third-party-advisory\", \"x_refsource_SECUNIA\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\", \"name\": \"SUSE-SA:2010:008\", \"tags\": [\"vendor-advisory\", \"x_refsource_SUSE\"]}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\", \"name\": \"TA10-013A\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\"]}, {\"url\": \"http://www.securityfocus.com/bid/37758\", \"name\": \"37758\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \\\"array boundary issue,\\\" a different vulnerability than CVE-2009-2994.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\", \"dateUpdated\": \"2017-09-18T12:57:01.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}, \"product_name\": \"n/a\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\", \"name\": \"http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl\", \"refsource\": \"MISC\"}, {\"url\": \"http://secunia.com/advisories/38138\", \"name\": \"38138\", \"refsource\": \"SECUNIA\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242\", \"name\": \"oval:org.mitre.oval:def:8242\", \"refsource\": \"OVAL\"}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb10-02.html\", \"name\": \"http://www.adobe.com/support/security/bulletins/apsb10-02.html\", \"refsource\": \"CONFIRM\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2010-0060.html\", \"name\": \"RHSA-2010:0060\", \"refsource\": \"REDHAT\"}, {\"url\": \"http://www.vupen.com/english/advisories/2010/0103\", \"name\": \"ADV-2010-0103\", \"refsource\": \"VUPEN\"}, {\"url\": \"http://www.securitytracker.com/id?1023446\", \"name\": \"1023446\", \"refsource\": \"SECTRACK\"}, {\"url\": \"http://osvdb.org/61690\", \"name\": \"61690\", \"refsource\": \"OSVDB\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=554293\", \"name\": \"https://bugzilla.redhat.com/show_bug.cgi?id=554293\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/55551\", \"name\": \"acrobat-reader-u3d-code-execution(55551)\", \"refsource\": \"XF\"}, {\"url\": \"http://secunia.com/advisories/38215\", \"name\": \"38215\", \"refsource\": \"SECUNIA\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html\", \"name\": \"SUSE-SA:2010:008\", \"refsource\": \"SUSE\"}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA10-013A.html\", \"name\": \"TA10-013A\", \"refsource\": \"CERT\"}, {\"url\": \"http://www.securityfocus.com/bid/37758\", \"name\": \"37758\", \"refsource\": \"BID\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \\\"array boundary issue,\\\" a different vulnerability than CVE-2009-2994.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2009-3953\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"psirt@adobe.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2009-3953\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T20:04:25.417Z\", \"dateReserved\": \"2009-11-16T00:00:00.000Z\", \"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"datePublished\": \"2010-01-13T19:00:00.000Z\", \"assignerShortName\": \"adobe\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

VAR-200912-0756

Vulnerability from variot - Updated: 2024-07-23 21:40

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994. CVE-2009-2994 Is a different vulnerability.by the attacker ' Array Bounds Problem ' Arbitrary code may be executed via vectors related to. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Reader and Acrobat 9.2 and prior versions. NOTE: This issue was previously covered in BID 37667 (Adobe Acrobat and Reader January 2010 Multiple Remote Vulnerabilities), but has been given its own record to better document it. An array indexing error vulnerability exists in Adobe Reader and Acrobat's 3difr.x3d when processing U3D CLOD Mesh Declaration blocks. Users tricked into opening a PDF document containing a specially crafted U3D model will trigger memory corruption, resulting in the execution of arbitrary instructions. The Adobe Reader browser plug-in is available for several web browsers and operating systems and will automatically open PDF documents on websites. ----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)

If not, then implement it through the most reliable vulnerability intelligence source on the market.

Implement it through Secunia.

For more information visit: http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com

TITLE: Adobe Reader/Acrobat Code Execution Vulnerability

SECUNIA ADVISORY ID: SA37690

VERIFY ADVISORY: http://secunia.com/advisories/37690/

DESCRIPTION: A vulnerability has been reported in Adobe Reader and Acrobat, which can be exploited by malicious people to compromise a user's system.

NOTE: This vulnerability is currently being actively exploited.

SOLUTION: Do not open untrusted PDF files.

Do not visit untrusted websites or follow untrusted links.

PROVIDED AND/OR DISCOVERED BY: Reported as a 0-day.

ORIGINAL ADVISORY: http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Affected packages

-------------------------------------------------------------------
 Package            /  Vulnerable  /                    Unaffected
-------------------------------------------------------------------

1 app-text/acroread < 9.3.4 >= 9.3.4

Description

Multiple vulnerabilities were discovered in Adobe Reader. For further information please consult the CVE entries and the Adobe Security Bulletins referenced below.

Impact

A remote attacker might entice a user to open a specially crafted PDF file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, or bypass intended sandbox restrictions, make cross-domain requests, inject arbitrary web script or HTML, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Adobe Reader users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"

References

[ 1 ] APSA10-01 http://www.adobe.com/support/security/advisories/apsa10-01.html [ 2 ] APSB10-02 http://www.adobe.com/support/security/bulletins/apsb10-02.html [ 3 ] APSB10-07 http://www.adobe.com/support/security/bulletins/apsb10-07.html [ 4 ] APSB10-09 http://www.adobe.com/support/security/bulletins/apsb10-09.html [ 5 ] APSB10-14 http://www.adobe.com/support/security/bulletins/apsb10-14.html [ 6 ] APSB10-16 http://www.adobe.com/support/security/bulletins/apsb10-16.html [ 7 ] CVE-2009-3953 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953 [ 8 ] CVE-2009-4324 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324 [ 9 ] CVE-2010-0186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186 [ 10 ] CVE-2010-0188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188 [ 11 ] CVE-2010-0190 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190 [ 12 ] CVE-2010-0191 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191 [ 13 ] CVE-2010-0192 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192 [ 14 ] CVE-2010-0193 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193 [ 15 ] CVE-2010-0194 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194 [ 16 ] CVE-2010-0195 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195 [ 17 ] CVE-2010-0196 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196 [ 18 ] CVE-2010-0197 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197 [ 19 ] CVE-2010-0198 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198 [ 20 ] CVE-2010-0199 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199 [ 21 ] CVE-2010-0201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201 [ 22 ] CVE-2010-0202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202 [ 23 ] CVE-2010-0203 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203 [ 24 ] CVE-2010-0204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204 [ 25 ] CVE-2010-1241 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241 [ 26 ] CVE-2010-1285 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285 [ 27 ] CVE-2010-1295 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295 [ 28 ] CVE-2010-1297 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297 [ 29 ] CVE-2010-2168 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168 [ 30 ] CVE-2010-2201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201 [ 31 ] CVE-2010-2202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202 [ 32 ] CVE-2010-2203 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203 [ 33 ] CVE-2010-2204 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204 [ 34 ] CVE-2010-2205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205 [ 35 ] CVE-2010-2206 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206 [ 36 ] CVE-2010-2207 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207 [ 37 ] CVE-2010-2208 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208 [ 38 ] CVE-2010-2209 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209 [ 39 ] CVE-2010-2210 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210 [ 40 ] CVE-2010-2211 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211 [ 41 ] CVE-2010-2212 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201009-05.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200912-0756",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "acrobat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "adobe",
        "version": "9.0"
      },
      {
        "model": "acrobat",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "adobe",
        "version": "7.1.4"
      },
      {
        "model": "linux enterprise",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "suse",
        "version": "10.0"
      },
      {
        "model": "acrobat",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "adobe",
        "version": "8.2"
      },
      {
        "model": "acrobat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "adobe",
        "version": "8.0"
      },
      {
        "model": "linux enterprise debuginfo",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "11.1"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "11.2"
      },
      {
        "model": "acrobat",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "adobe",
        "version": "7.0"
      },
      {
        "model": "acrobat",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "adobe",
        "version": "9.3"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "adobe",
        "version": "6.0.1"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "adobe",
        "version": null
      },
      {
        "model": "adobe reader",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30a2\u30c9\u30d3",
        "version": null
      },
      {
        "model": "rhel supplementary",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": "eus 5.4.z (server)"
      },
      {
        "model": "adobe acrobat",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30a2\u30c9\u30d3",
        "version": null
      },
      {
        "model": "rhel supplementary eus",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": "5.4.z (server)"
      },
      {
        "model": "red hat enterprise linux extras",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "rhel supplementary",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": "5 (server)"
      },
      {
        "model": "rhel desktop supplementary",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "5.0.5"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "5.0.6"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "6.0.4"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "6.0.2"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "6.0.5"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "6.0"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "5.0.10"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "6.0.3"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "adobe",
        "version": "5.0"
      },
      {
        "model": "linux enterprise desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "11"
      },
      {
        "model": "linux enterprise sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "linux enterprise sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "suse",
        "version": "10"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "11.2"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "11.1"
      },
      {
        "model": "opensuse",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "s u s e",
        "version": "11.0"
      },
      {
        "model": "enterprise linux ws extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "enterprise linux ws extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "enterprise linux supplementary server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5"
      },
      {
        "model": "enterprise linux extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "enterprise linux extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "enterprise linux es extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "enterprise linux es extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "enterprise linux desktop supplementary client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "5"
      },
      {
        "model": "enterprise linux as extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "enterprise linux as extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "desktop extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "desktop extras",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "linux",
        "scope": null,
        "trust": 0.3,
        "vendor": "gentoo",
        "version": null
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.3"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.2"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.1"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.7"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.6"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.5"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.4"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.3"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.2"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.1"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "7.0.9"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "6.0.1"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.2"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.0"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1"
      },
      {
        "model": "reader",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.0"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.3"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.2"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.7"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.6"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.4"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.3"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.2"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.1"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.2"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1"
      },
      {
        "model": "acrobat standard",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.0"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.3"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.2"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.7"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.6"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.4"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.3"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.2"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1.1"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.2"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.1"
      },
      {
        "model": "acrobat professional",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.0"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.1.1"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "7.0.9"
      },
      {
        "model": "acrobat",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.2"
      },
      {
        "model": "reader",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.3"
      },
      {
        "model": "reader",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.2"
      },
      {
        "model": "acrobat standard",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.3"
      },
      {
        "model": "acrobat standard",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.2"
      },
      {
        "model": "acrobat professional",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.3"
      },
      {
        "model": "acrobat professional",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "8.2"
      },
      {
        "model": "acrobat",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "adobe",
        "version": "9.3"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "db": "BID",
        "id": "37758"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "9.2",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "9.2",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:unix:unix:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Parvez Anwar",
    "sources": [
      {
        "db": "BID",
        "id": "37758"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2009-3953",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 10.0,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "CVE-2009-3953",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-41399",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 8.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2009-3953",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2009-3953",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CARNEGIE MELLON",
            "id": "VU#508357",
            "trust": 0.8,
            "value": "65.84"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201001-099",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-41399",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2009-3953",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994. CVE-2009-2994 Is a different vulnerability.by the attacker \u0027 Array Bounds Problem \u0027 Arbitrary code may be executed via vectors related to. Failed exploit attempts will likely cause denial-of-service conditions. \nThis issue affects Reader and Acrobat 9.2 and prior versions. \nNOTE: This issue was previously covered in BID 37667 (Adobe Acrobat and Reader January 2010 Multiple Remote Vulnerabilities), but has been given its own record to better document it. An array indexing error vulnerability exists in Adobe Reader and Acrobat\u0027s 3difr.x3d when processing U3D CLOD Mesh Declaration blocks. Users tricked into opening a PDF document containing a specially crafted U3D model will trigger memory corruption, resulting in the execution of arbitrary instructions. The Adobe Reader browser plug-in is available for several web browsers and operating systems and will automatically open PDF documents on websites. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management)  \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nFor more information visit:\nhttp://secunia.com/advisories/business_solutions/\n\nAlternatively request a call from a Secunia representative today to\ndiscuss how we can help you with our capabilities contact us at:\nsales@secunia.com\n\n----------------------------------------------------------------------\n\nTITLE:\nAdobe Reader/Acrobat Code Execution Vulnerability\n\nSECUNIA ADVISORY ID:\nSA37690\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/37690/\n\nDESCRIPTION:\nA vulnerability has been reported in Adobe Reader and Acrobat, which\ncan be exploited by malicious people to compromise a user\u0027s system. \n\nNOTE: This vulnerability is currently being actively exploited. \n\nSOLUTION:\nDo not open untrusted PDF files. \n\nDo not visit untrusted websites or follow untrusted links. \n\nPROVIDED AND/OR DISCOVERED BY:\nReported as a 0-day. \n\nORIGINAL ADVISORY:\nhttp://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package            /  Vulnerable  /                    Unaffected\n    -------------------------------------------------------------------\n  1  app-text/acroread       \u003c 9.3.4                          \u003e= 9.3.4\n\nDescription\n===========\n\nMultiple vulnerabilities were discovered in Adobe Reader. For further\ninformation please consult the CVE entries and the Adobe Security\nBulletins referenced below. \n\nImpact\n======\n\nA remote attacker might entice a user to open a specially crafted PDF\nfile, possibly resulting in the execution of arbitrary code with the\nprivileges of the user running the application, or bypass intended\nsandbox restrictions, make cross-domain requests, inject arbitrary web\nscript or HTML, or cause a Denial of Service condition. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Adobe Reader users should upgrade to the latest version:\n\n    # emerge --sync\n    # emerge --ask --oneshot --verbose \"\u003e=app-text/acroread-9.3.4\"\n\nReferences\n==========\n\n  [ 1 ] APSA10-01\n        http://www.adobe.com/support/security/advisories/apsa10-01.html\n  [ 2 ] APSB10-02\n        http://www.adobe.com/support/security/bulletins/apsb10-02.html\n  [ 3 ] APSB10-07\n        http://www.adobe.com/support/security/bulletins/apsb10-07.html\n  [ 4 ] APSB10-09\n        http://www.adobe.com/support/security/bulletins/apsb10-09.html\n  [ 5 ] APSB10-14\n        http://www.adobe.com/support/security/bulletins/apsb10-14.html\n  [ 6 ] APSB10-16\n        http://www.adobe.com/support/security/bulletins/apsb10-16.html\n  [ 7 ] CVE-2009-3953\n        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953\n  [ 8 ] CVE-2009-4324\n        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324\n  [ 9 ] CVE-2010-0186\n        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186\n  [ 10 ] CVE-2010-0188\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188\n  [ 11 ] CVE-2010-0190\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190\n  [ 12 ] CVE-2010-0191\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191\n  [ 13 ] CVE-2010-0192\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192\n  [ 14 ] CVE-2010-0193\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193\n  [ 15 ] CVE-2010-0194\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194\n  [ 16 ] CVE-2010-0195\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195\n  [ 17 ] CVE-2010-0196\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196\n  [ 18 ] CVE-2010-0197\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197\n  [ 19 ] CVE-2010-0198\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198\n  [ 20 ] CVE-2010-0199\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199\n  [ 21 ] CVE-2010-0201\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201\n  [ 22 ] CVE-2010-0202\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202\n  [ 23 ] CVE-2010-0203\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203\n  [ 24 ] CVE-2010-0204\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204\n  [ 25 ] CVE-2010-1241\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241\n  [ 26 ] CVE-2010-1285\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285\n  [ 27 ] CVE-2010-1295\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295\n  [ 28 ] CVE-2010-1297\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297\n  [ 29 ] CVE-2010-2168\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168\n  [ 30 ] CVE-2010-2201\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201\n  [ 31 ] CVE-2010-2202\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202\n  [ 32 ] CVE-2010-2203\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203\n  [ 33 ] CVE-2010-2204\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204\n  [ 34 ] CVE-2010-2205\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205\n  [ 35 ] CVE-2010-2206\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206\n  [ 36 ] CVE-2010-2207\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207\n  [ 37 ] CVE-2010-2208\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208\n  [ 38 ] CVE-2010-2209\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209\n  [ 39 ] CVE-2010-2210\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210\n  [ 40 ] CVE-2010-2211\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211\n  [ 41 ] CVE-2010-2212\n         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n  http://security.gentoo.org/glsa/glsa-201009-05.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2010 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      },
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "BID",
        "id": "37758"
      },
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "db": "PACKETSTORM",
        "id": "83870"
      },
      {
        "db": "PACKETSTORM",
        "id": "93607"
      }
    ],
    "trust": 2.97
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-41399",
        "trust": 0.1,
        "type": "unknown"
      },
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=16622",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2009-3953",
        "trust": 3.8
      },
      {
        "db": "VUPEN",
        "id": "ADV-2010-0103",
        "trust": 2.6
      },
      {
        "db": "SECTRACK",
        "id": "1023446",
        "trust": 2.6
      },
      {
        "db": "USCERT",
        "id": "TA10-013A",
        "trust": 2.6
      },
      {
        "db": "BID",
        "id": "37758",
        "trust": 2.3
      },
      {
        "db": "OSVDB",
        "id": "61690",
        "trust": 1.2
      },
      {
        "db": "SECUNIA",
        "id": "38215",
        "trust": 1.2
      },
      {
        "db": "SECUNIA",
        "id": "38138",
        "trust": 1.2
      },
      {
        "db": "SECUNIA",
        "id": "37690",
        "trust": 0.9
      },
      {
        "db": "OSVDB",
        "id": "60980",
        "trust": 0.8
      },
      {
        "db": "CERT/CC",
        "id": "VU#508357",
        "trust": 0.8
      },
      {
        "db": "USCERT",
        "id": "TA15-119A",
        "trust": 0.8
      },
      {
        "db": "USCERT",
        "id": "SA10-013A",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099",
        "trust": 0.7
      },
      {
        "db": "NSFOCUS",
        "id": "14347",
        "trust": 0.6
      },
      {
        "db": "CERT/CC",
        "id": "TA10-013A",
        "trust": 0.6
      },
      {
        "db": "SUSE",
        "id": "SUSE-SA:2010:008",
        "trust": 0.6
      },
      {
        "db": "EXPLOIT-DB",
        "id": "16622",
        "trust": 0.2
      },
      {
        "db": "PACKETSTORM",
        "id": "93607",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-41399",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "83870",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "db": "BID",
        "id": "37758"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "PACKETSTORM",
        "id": "83870"
      },
      {
        "db": "PACKETSTORM",
        "id": "93607"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "id": "VAR-200912-0756",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-07-23T21:40:51.958000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "TA10-013A",
        "trust": 0.8,
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "title": "Adobe Acrobat 9.3.1 Pro and Standard update - multiple languages",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4049"
      },
      {
        "title": "Adobe Reader 8.1.7",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4048"
      },
      {
        "title": "Adobe Acrobat 9.3.1 Pro update - multiple languages",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4052"
      },
      {
        "title": "Adobe Reader 9.3",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4047"
      },
      {
        "title": "Adobe Acrobat 3D 8.2.1 update - multiple languages",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4051"
      },
      {
        "title": "Adobe Reader 9.3",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4046"
      },
      {
        "title": "Adobe Acrobat 9.3.1 Pro Extended update - multiple languages",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=4050"
      },
      {
        "title": "Red Hat: Critical: acroread security and bug fix update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20100037 - security advisory"
      },
      {
        "title": "Red Hat: Critical: acroread security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20100060 - security advisory"
      },
      {
        "title": "Red Hat: Critical: acroread security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20100038 - security advisory"
      },
      {
        "title": "Known Exploited Vulnerabilities Detector",
        "trust": 0.1,
        "url": "https://github.com/ostorlab/kev "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.0
      },
      {
        "problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
        "trust": 0.8
      },
      {
        "problemtype": "CWE-119",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.6,
        "url": "http://www.us-cert.gov/cas/techalerts/ta10-013a.html"
      },
      {
        "trust": 2.6,
        "url": "http://www.securitytracker.com/id?1023446"
      },
      {
        "trust": 2.6,
        "url": "http://www.vupen.com/english/advisories/2010/0103"
      },
      {
        "trust": 2.2,
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "trust": 2.1,
        "url": "http://www.securityfocus.com/bid/37758"
      },
      {
        "trust": 1.8,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
      },
      {
        "trust": 1.7,
        "url": "http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html"
      },
      {
        "trust": 1.2,
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "trust": 1.2,
        "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
      },
      {
        "trust": 1.2,
        "url": "http://osvdb.org/61690"
      },
      {
        "trust": 1.2,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a8242"
      },
      {
        "trust": 1.2,
        "url": "http://www.redhat.com/support/errata/rhsa-2010-0060.html"
      },
      {
        "trust": 1.2,
        "url": "http://secunia.com/advisories/38138"
      },
      {
        "trust": 1.2,
        "url": "http://secunia.com/advisories/38215"
      },
      {
        "trust": 1.2,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
      },
      {
        "trust": 0.9,
        "url": "http://secunia.com/advisories/37690/"
      },
      {
        "trust": 0.8,
        "url": "http://www.adobe.com/support/security/advisories/apsa09-07.html"
      },
      {
        "trust": 0.8,
        "url": "http://kb2.adobe.com/cps/532/cpsid_53237.html"
      },
      {
        "trust": 0.8,
        "url": "http://osvdb.org/show/osvdb/60980"
      },
      {
        "trust": 0.8,
        "url": "http://www.symantec.com/connect/blogs/zero-day-xmas-present"
      },
      {
        "trust": 0.8,
        "url": "http://voices.washingtonpost.com/securityfix/2009/12/hackers_target_unpatched_adobe.html"
      },
      {
        "trust": 0.8,
        "url": "http://vrt-sourcefire.blogspot.com/2009/12/this-is-what-happens-when-you-try-to-do.html"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnta10-013a/"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/ta/jvnta99041988/"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/tr/jvntr-2010-03/"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-3953"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/at/2010/at100003.txt"
      },
      {
        "trust": 0.8,
        "url": "http://www.npa.go.jp/cyberpolice/index.html#topics"
      },
      {
        "trust": 0.8,
        "url": "http://www.us-cert.gov/cas/alerts/sa10-013a.html"
      },
      {
        "trust": 0.8,
        "url": "https://www.us-cert.gov/ncas/alerts/ta15-119a"
      },
      {
        "trust": 0.8,
        "url": "https://cisa.gov/known-exploited-vulnerabilities-catalog"
      },
      {
        "trust": 0.8,
        "url": "http://www.ipa.go.jp/security/ciadr/vul/20100113-adobe.html"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/14347"
      },
      {
        "trust": 0.3,
        "url": "http://www.adobe.com"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2010:0037"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/16622/"
      },
      {
        "trust": 0.1,
        "url": "https://www.rapid7.com/db/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/business_solutions/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2203"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-4324"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2209"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0188"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0194"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0202"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0194"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0199"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/glsa/glsa-201009-05.xml"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2202"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2205"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2206"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0203"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0197"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2211"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1285"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2204"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0199"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0192"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0186"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0190"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0196"
      },
      {
        "trust": 0.1,
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-14.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3953"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4324"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0191"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0202"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0204"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0201"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2210"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0197"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0188"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0198"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0191"
      },
      {
        "trust": 0.1,
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-07.html"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1297"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1241"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1295"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0192"
      },
      {
        "trust": 0.1,
        "url": "http://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "http://www.adobe.com/support/security/advisories/apsa10-01.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-3953"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0203"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2208"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0190"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0193"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0198"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2207"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0195"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0204"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2168"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0201"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0196"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2201"
      },
      {
        "trust": 0.1,
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-09.html"
      },
      {
        "trust": 0.1,
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-16.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0193"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0186"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2010-0195"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2212"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "db": "BID",
        "id": "37758"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "PACKETSTORM",
        "id": "83870"
      },
      {
        "db": "PACKETSTORM",
        "id": "93607"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "db": "BID",
        "id": "37758"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "db": "PACKETSTORM",
        "id": "83870"
      },
      {
        "db": "PACKETSTORM",
        "id": "93607"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2009-12-15T00:00:00",
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "date": "2010-01-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "date": "2010-01-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "date": "2010-01-12T00:00:00",
        "db": "BID",
        "id": "37758"
      },
      {
        "date": "2010-02-10T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "date": "2009-12-15T13:39:57",
        "db": "PACKETSTORM",
        "id": "83870"
      },
      {
        "date": "2010-09-08T05:23:46",
        "db": "PACKETSTORM",
        "id": "93607"
      },
      {
        "date": "2010-01-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "date": "2010-01-13T19:30:00.343000",
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2010-06-18T00:00:00",
        "db": "CERT/CC",
        "id": "VU#508357"
      },
      {
        "date": "2018-10-30T00:00:00",
        "db": "VULHUB",
        "id": "VHN-41399"
      },
      {
        "date": "2018-10-30T00:00:00",
        "db": "VULMON",
        "id": "CVE-2009-3953"
      },
      {
        "date": "2010-09-07T21:12:00",
        "db": "BID",
        "id": "37758"
      },
      {
        "date": "2024-07-02T02:14:00",
        "db": "JVNDB",
        "id": "JVNDB-2010-001014"
      },
      {
        "date": "2011-07-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      },
      {
        "date": "2024-06-28T14:20:25.363000",
        "db": "NVD",
        "id": "CVE-2009-3953"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Adobe Acrobat and Reader contain a use-after-free vulnerability in the JavaScript Doc.media.newPlayer method",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#508357"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201001-099"
      }
    ],
    "trust": 0.6
  }
}

RHSA-2010:0037

Vulnerability from csaf_redhat - Published: 2010-01-13 16:03 - Updated: 2025-11-21 17:35

Summary

Red Hat Security Advisory: acroread security and bug fix update

Notes

Topic

Updated acroread packages that fix multiple security issues and three bugs are now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team.

Details

Adobe Reader allows users to view and print documents in Portable Document Format (PDF). This update fixes several vulnerabilities in Adobe Reader. These vulnerabilities are summarized on the Adobe Security Advisory APSB10-02 page listed in the References section. A specially-crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953, CVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956) This update also fixes the following bugs: * the acroread process continued to run even after closing a PDF file. If multiple PDF files were opened and then closed, the acroread processes continued to run and consume system resources (up to 100% CPU usage). With this update, the acroread process correctly exits, which resolves this issue. (BZ#473217) * the PPKLite.api plug-in was missing, causing Adobe Reader to crash when attempting to open signed PDF files. For such files, if an immediate crash was not observed, clicking on the Signature Panel could trigger one. With this update, the PPKLite.api plug-in is included, which resolves this issue. (BZ#472975) * Adobe Reader has been upgraded to version 9.3. (BZ#497957) Adobe have discontinued support for Adobe Reader 8 for Linux. All users of Adobe Reader are advised to install these updated packages, which contain Adobe Reader version 9.3, which is not vulnerable to these issues and fixes these bugs. All running instances of Adobe Reader must be restarted for the update to take effect.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated acroread packages that fix multiple security issues and three bugs\nare now available for Red Hat Enterprise Linux 5 Supplementary.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nThis update fixes several vulnerabilities in Adobe Reader. These\nvulnerabilities are summarized on the Adobe Security Advisory APSB10-02\npage listed in the References section. A specially-crafted PDF file could\ncause Adobe Reader to crash or, potentially, execute arbitrary code as the\nuser running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953,\nCVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nThis update also fixes the following bugs:\n\n* the acroread process continued to run even after closing a PDF file. If\nmultiple PDF files were opened and then closed, the acroread processes\ncontinued to run and consume system resources (up to 100% CPU usage). With\nthis update, the acroread process correctly exits, which resolves this\nissue. (BZ#473217)\n\n* the PPKLite.api plug-in was missing, causing Adobe Reader to crash when\nattempting to open signed PDF files. For such files, if an immediate crash\nwas not observed, clicking on the Signature Panel could trigger one. With\nthis update, the PPKLite.api plug-in is included, which resolves this\nissue. (BZ#472975)\n\n* Adobe Reader has been upgraded to version 9.3. (BZ#497957)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. All users of\nAdobe Reader are advised to install these updated packages, which contain\nAdobe Reader version 9.3, which is not vulnerable to these issues and fixes\nthese bugs. All running instances of Adobe Reader must be restarted for the\nupdate to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0037",
        "url": "https://access.redhat.com/errata/RHSA-2010:0037"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "category": "external",
        "summary": "472975",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=472975"
      },
      {
        "category": "external",
        "summary": "473217",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=473217"
      },
      {
        "category": "external",
        "summary": "547799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
      },
      {
        "category": "external",
        "summary": "554293",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "category": "external",
        "summary": "554296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0037.json"
      }
    ],
    "title": "Red Hat Security Advisory: acroread security and bug fix update",
    "tracking": {
      "current_release_date": "2025-11-21T17:35:42+00:00",
      "generator": {
        "date": "2025-11-21T17:35:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2010:0037",
      "initial_release_date": "2010-01-13T16:03:00+00:00",
      "revision_history": [
        {
          "date": "2010-01-13T16:03:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-01-13T11:03:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:35:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
                  "product_id": "5Client-Supplementary",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Supplementary (v. 5)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Supplementary (v. 5)",
                  "product_id": "5Server-Supplementary",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acroread-plugin-0:9.3-1.el5.i386",
                "product": {
                  "name": "acroread-plugin-0:9.3-1.el5.i386",
                  "product_id": "acroread-plugin-0:9.3-1.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread-plugin@9.3-1.el5?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "acroread-0:9.3-1.el5.i386",
                "product": {
                  "name": "acroread-0:9.3-1.el5.i386",
                  "product_id": "acroread-0:9.3-1.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread@9.3-1.el5?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
          "product_id": "5Client-Supplementary:acroread-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Client-Supplementary"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
          "product_id": "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Client-Supplementary"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)",
          "product_id": "5Server-Supplementary:acroread-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Server-Supplementary"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)",
          "product_id": "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Server-Supplementary"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3953",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3954",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3955",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3956",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: script injection vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "RHBZ#554296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "acroread: script injection vulnerability (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3959",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-4324",
      "discovery_date": "2009-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "547799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "RHBZ#547799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2009-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)"
    }
  ]
}

RHSA-2010_0060

Vulnerability from csaf_redhat - Published: 2010-01-20 14:38 - Updated: 2024-11-14 10:47

Summary

Red Hat Security Advisory: acroread security update

Notes

Topic

The acroread packages as shipped in Red Hat Enterprise Linux 3 Extras contain security flaws and should not be used. This update has been rated as having critical security impact by the Red Hat Security Response Team.

Details

Adobe Reader allows users to view and print documents in Portable Document Format (PDF). Adobe Reader 8.1.7 is vulnerable to critical security flaws and should no longer be used. A specially-crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953, CVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956) Adobe have discontinued support for Adobe Reader 8 for Linux. Adobe Reader 9 for Linux is not compatible with Red Hat Enterprise Linux 3. An alternative PDF file viewer available in Red Hat Enterprise Linux 3 is xpdf. This update removes the acroread packages due to their known security vulnerabilities.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The acroread packages as shipped in Red Hat Enterprise Linux 3 Extras\ncontain security flaws and should not be used.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nAdobe Reader 8.1.7 is vulnerable to critical security flaws and should no\nlonger be used. A specially-crafted PDF file could cause Adobe Reader to\ncrash or, potentially, execute arbitrary code as the user running Adobe\nReader when opened. (CVE-2009-4324, CVE-2009-3953, CVE-2009-3954,\nCVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. Adobe Reader\n9 for Linux is not compatible with Red Hat Enterprise Linux 3. An\nalternative PDF file viewer available in Red Hat Enterprise Linux 3 is\nxpdf.\n\nThis update removes the acroread packages due to their known security\nvulnerabilities.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0060",
        "url": "https://access.redhat.com/errata/RHSA-2010:0060"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "category": "external",
        "summary": "547799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
      },
      {
        "category": "external",
        "summary": "554293",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "category": "external",
        "summary": "554296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0060.json"
      }
    ],
    "title": "Red Hat Security Advisory: acroread security update",
    "tracking": {
      "current_release_date": "2024-11-14T10:47:51+00:00",
      "generator": {
        "date": "2024-11-14T10:47:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2010:0060",
      "initial_release_date": "2010-01-20T14:38:00+00:00",
      "revision_history": [
        {
          "date": "2010-01-20T14:38:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-01-20T09:38:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T10:47:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 3 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 3 Extras",
                  "product_id": "3AS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 3 Extras",
                "product": {
                  "name": "Red Hat Desktop version 3 Extras",
                  "product_id": "3Desktop-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 3 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 3 Extras",
                  "product_id": "3ES-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 3 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 3 Extras",
                  "product_id": "3WS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acroread-uninstall-0:9.3-3.i386",
                "product": {
                  "name": "acroread-uninstall-0:9.3-3.i386",
                  "product_id": "acroread-uninstall-0:9.3-3.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread-uninstall@9.3-3?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux AS version 3 Extras",
          "product_id": "3AS-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3AS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Desktop version 3 Extras",
          "product_id": "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3Desktop-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux ES version 3 Extras",
          "product_id": "3ES-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3ES-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux WS version 3 Extras",
          "product_id": "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3WS-LACD"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3953",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3954",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3955",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3956",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: script injection vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "RHBZ#554296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "acroread: script injection vulnerability (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3959",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-4324",
      "discovery_date": "2009-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "547799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "RHBZ#547799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2009-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)"
    }
  ]
}

RHSA-2010_0037

Vulnerability from csaf_redhat - Published: 2010-01-13 16:03 - Updated: 2024-11-14 10:47

Summary

Red Hat Security Advisory: acroread security and bug fix update

Notes

Topic

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated acroread packages that fix multiple security issues and three bugs\nare now available for Red Hat Enterprise Linux 5 Supplementary.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nThis update fixes several vulnerabilities in Adobe Reader. These\nvulnerabilities are summarized on the Adobe Security Advisory APSB10-02\npage listed in the References section. A specially-crafted PDF file could\ncause Adobe Reader to crash or, potentially, execute arbitrary code as the\nuser running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953,\nCVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nThis update also fixes the following bugs:\n\n* the acroread process continued to run even after closing a PDF file. If\nmultiple PDF files were opened and then closed, the acroread processes\ncontinued to run and consume system resources (up to 100% CPU usage). With\nthis update, the acroread process correctly exits, which resolves this\nissue. (BZ#473217)\n\n* the PPKLite.api plug-in was missing, causing Adobe Reader to crash when\nattempting to open signed PDF files. For such files, if an immediate crash\nwas not observed, clicking on the Signature Panel could trigger one. With\nthis update, the PPKLite.api plug-in is included, which resolves this\nissue. (BZ#472975)\n\n* Adobe Reader has been upgraded to version 9.3. (BZ#497957)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. All users of\nAdobe Reader are advised to install these updated packages, which contain\nAdobe Reader version 9.3, which is not vulnerable to these issues and fixes\nthese bugs. All running instances of Adobe Reader must be restarted for the\nupdate to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0037",
        "url": "https://access.redhat.com/errata/RHSA-2010:0037"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "category": "external",
        "summary": "472975",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=472975"
      },
      {
        "category": "external",
        "summary": "473217",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=473217"
      },
      {
        "category": "external",
        "summary": "547799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
      },
      {
        "category": "external",
        "summary": "554293",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "category": "external",
        "summary": "554296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0037.json"
      }
    ],
    "title": "Red Hat Security Advisory: acroread security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T10:47:38+00:00",
      "generator": {
        "date": "2024-11-14T10:47:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2010:0037",
      "initial_release_date": "2010-01-13T16:03:00+00:00",
      "revision_history": [
        {
          "date": "2010-01-13T16:03:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-01-13T11:03:38+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T10:47:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
                  "product_id": "5Client-Supplementary",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Server Supplementary (v. 5)",
                "product": {
                  "name": "Red Hat Enterprise Linux Server Supplementary (v. 5)",
                  "product_id": "5Server-Supplementary",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acroread-plugin-0:9.3-1.el5.i386",
                "product": {
                  "name": "acroread-plugin-0:9.3-1.el5.i386",
                  "product_id": "acroread-plugin-0:9.3-1.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread-plugin@9.3-1.el5?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "acroread-0:9.3-1.el5.i386",
                "product": {
                  "name": "acroread-0:9.3-1.el5.i386",
                  "product_id": "acroread-0:9.3-1.el5.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread@9.3-1.el5?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
          "product_id": "5Client-Supplementary:acroread-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Client-Supplementary"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)",
          "product_id": "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Client-Supplementary"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)",
          "product_id": "5Server-Supplementary:acroread-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Server-Supplementary"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el5.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)",
          "product_id": "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el5.i386",
        "relates_to_product_reference": "5Server-Supplementary"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3953",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3954",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3955",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3956",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: script injection vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "RHBZ#554296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "acroread: script injection vulnerability (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3959",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-4324",
      "discovery_date": "2009-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "547799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
          "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "RHBZ#547799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2009-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:03:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0037"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Client-Supplementary:acroread-plugin-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-0:9.3-1.el5.i386",
            "5Server-Supplementary:acroread-plugin-0:9.3-1.el5.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)"
    }
  ]
}

RHSA-2010:0060

Vulnerability from csaf_redhat - Published: 2010-01-20 14:38 - Updated: 2025-11-21 17:35

Summary

Red Hat Security Advisory: acroread security update

Notes

Topic

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The acroread packages as shipped in Red Hat Enterprise Linux 3 Extras\ncontain security flaws and should not be used.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nAdobe Reader 8.1.7 is vulnerable to critical security flaws and should no\nlonger be used. A specially-crafted PDF file could cause Adobe Reader to\ncrash or, potentially, execute arbitrary code as the user running Adobe\nReader when opened. (CVE-2009-4324, CVE-2009-3953, CVE-2009-3954,\nCVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. Adobe Reader\n9 for Linux is not compatible with Red Hat Enterprise Linux 3. An\nalternative PDF file viewer available in Red Hat Enterprise Linux 3 is\nxpdf.\n\nThis update removes the acroread packages due to their known security\nvulnerabilities.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0060",
        "url": "https://access.redhat.com/errata/RHSA-2010:0060"
      },
      {
        "category": "external",
        "summary": "554296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "category": "external",
        "summary": "547799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
      },
      {
        "category": "external",
        "summary": "554293",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0060.json"
      }
    ],
    "title": "Red Hat Security Advisory: acroread security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:35:45+00:00",
      "generator": {
        "date": "2025-11-21T17:35:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2010:0060",
      "initial_release_date": "2010-01-20T14:38:00+00:00",
      "revision_history": [
        {
          "date": "2010-01-20T14:38:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-01-20T09:38:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:35:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 3 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 3 Extras",
                  "product_id": "3AS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 3 Extras",
                "product": {
                  "name": "Red Hat Desktop version 3 Extras",
                  "product_id": "3Desktop-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 3 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 3 Extras",
                  "product_id": "3ES-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 3 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 3 Extras",
                  "product_id": "3WS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acroread-uninstall-0:9.3-3.i386",
                "product": {
                  "name": "acroread-uninstall-0:9.3-3.i386",
                  "product_id": "acroread-uninstall-0:9.3-3.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread-uninstall@9.3-3?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux AS version 3 Extras",
          "product_id": "3AS-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3AS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Desktop version 3 Extras",
          "product_id": "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3Desktop-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux ES version 3 Extras",
          "product_id": "3ES-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3ES-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-uninstall-0:9.3-3.i386 as a component of Red Hat Enterprise Linux WS version 3 Extras",
          "product_id": "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        },
        "product_reference": "acroread-uninstall-0:9.3-3.i386",
        "relates_to_product_reference": "3WS-LACD"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3953",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3954",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3955",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3956",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: script injection vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "RHBZ#554296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "acroread: script injection vulnerability (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3959",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-4324",
      "discovery_date": "2009-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "547799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
          "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
          "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
          "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "RHBZ#547799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2009-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-20T14:38:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0060"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "3AS-LACD:acroread-uninstall-0:9.3-3.i386",
            "3Desktop-LACD:acroread-uninstall-0:9.3-3.i386",
            "3ES-LACD:acroread-uninstall-0:9.3-3.i386",
            "3WS-LACD:acroread-uninstall-0:9.3-3.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)"
    }
  ]
}

RHSA-2010_0038

Vulnerability from csaf_redhat - Published: 2010-01-13 16:08 - Updated: 2024-11-14 10:47

Summary

Red Hat Security Advisory: acroread security update

Notes

Topic

Updated acroread packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team.

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated acroread packages that fix multiple security issues are now\navailable for Red Hat Enterprise Linux 4 Extras.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nThis update fixes several vulnerabilities in Adobe Reader. These\nvulnerabilities are summarized on the Adobe Security Advisory APSB10-02\npage listed in the References section. A specially-crafted PDF file could\ncause Adobe Reader to crash or, potentially, execute arbitrary code as the\nuser running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953,\nCVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. All users of\nAdobe Reader are advised to install these updated packages, which contain\nAdobe Reader version 9.3, which is not vulnerable to these issues. All\nrunning instances of Adobe Reader must be restarted for the update to take\neffect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0038",
        "url": "https://access.redhat.com/errata/RHSA-2010:0038"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "category": "external",
        "summary": "547799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
      },
      {
        "category": "external",
        "summary": "554293",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "category": "external",
        "summary": "554296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0038.json"
      }
    ],
    "title": "Red Hat Security Advisory: acroread security update",
    "tracking": {
      "current_release_date": "2024-11-14T10:47:42+00:00",
      "generator": {
        "date": "2024-11-14T10:47:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2010:0038",
      "initial_release_date": "2010-01-13T16:08:00+00:00",
      "revision_history": [
        {
          "date": "2010-01-13T16:08:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-01-13T11:08:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T10:47:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 4 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 4 Extras",
                  "product_id": "4AS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 4 Extras",
                "product": {
                  "name": "Red Hat Desktop version 4 Extras",
                  "product_id": "4Desktop-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 4 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 4 Extras",
                  "product_id": "4ES-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 4 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 4 Extras",
                  "product_id": "4WS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acroread-plugin-0:9.3-1.el4.i386",
                "product": {
                  "name": "acroread-plugin-0:9.3-1.el4.i386",
                  "product_id": "acroread-plugin-0:9.3-1.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread-plugin@9.3-1.el4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "acroread-0:9.3-1.el4.i386",
                "product": {
                  "name": "acroread-0:9.3-1.el4.i386",
                  "product_id": "acroread-0:9.3-1.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread@9.3-1.el4?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras",
          "product_id": "4AS-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4AS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras",
          "product_id": "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4AS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Desktop version 4 Extras",
          "product_id": "4Desktop-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4Desktop-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Desktop version 4 Extras",
          "product_id": "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4Desktop-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras",
          "product_id": "4ES-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4ES-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras",
          "product_id": "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4ES-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras",
          "product_id": "4WS-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4WS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras",
          "product_id": "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4WS-LACD"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3953",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3954",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3955",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3956",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: script injection vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "RHBZ#554296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "acroread: script injection vulnerability (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3959",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-4324",
      "discovery_date": "2009-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "547799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "RHBZ#547799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2009-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)"
    }
  ]
}

RHSA-2010:0038

Vulnerability from csaf_redhat - Published: 2010-01-13 16:08 - Updated: 2025-11-21 17:35

Summary

Red Hat Security Advisory: acroread security update

Notes

Topic

Details

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated acroread packages that fix multiple security issues are now\navailable for Red Hat Enterprise Linux 4 Extras.\n\nThis update has been rated as having critical security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Adobe Reader allows users to view and print documents in Portable Document\nFormat (PDF).\n\nThis update fixes several vulnerabilities in Adobe Reader. These\nvulnerabilities are summarized on the Adobe Security Advisory APSB10-02\npage listed in the References section. A specially-crafted PDF file could\ncause Adobe Reader to crash or, potentially, execute arbitrary code as the\nuser running Adobe Reader when opened. (CVE-2009-4324, CVE-2009-3953,\nCVE-2009-3954, CVE-2009-3955, CVE-2009-3959, CVE-2009-3956)\n\nAdobe have discontinued support for Adobe Reader 8 for Linux. All users of\nAdobe Reader are advised to install these updated packages, which contain\nAdobe Reader version 9.3, which is not vulnerable to these issues. All\nrunning instances of Adobe Reader must be restarted for the update to take\neffect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0038",
        "url": "https://access.redhat.com/errata/RHSA-2010:0038"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
        "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
      },
      {
        "category": "external",
        "summary": "547799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
      },
      {
        "category": "external",
        "summary": "554293",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
      },
      {
        "category": "external",
        "summary": "554296",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0038.json"
      }
    ],
    "title": "Red Hat Security Advisory: acroread security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:35:43+00:00",
      "generator": {
        "date": "2025-11-21T17:35:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2010:0038",
      "initial_release_date": "2010-01-13T16:08:00+00:00",
      "revision_history": [
        {
          "date": "2010-01-13T16:08:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-01-13T11:08:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:35:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS version 4 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux AS version 4 Extras",
                  "product_id": "4AS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Desktop version 4 Extras",
                "product": {
                  "name": "Red Hat Desktop version 4 Extras",
                  "product_id": "4Desktop-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ES version 4 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux ES version 4 Extras",
                  "product_id": "4ES-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux WS version 4 Extras",
                "product": {
                  "name": "Red Hat Enterprise Linux WS version 4 Extras",
                  "product_id": "4WS-LACD",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_extras:4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux Supplementary"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "acroread-plugin-0:9.3-1.el4.i386",
                "product": {
                  "name": "acroread-plugin-0:9.3-1.el4.i386",
                  "product_id": "acroread-plugin-0:9.3-1.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread-plugin@9.3-1.el4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "acroread-0:9.3-1.el4.i386",
                "product": {
                  "name": "acroread-0:9.3-1.el4.i386",
                  "product_id": "acroread-0:9.3-1.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/acroread@9.3-1.el4?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras",
          "product_id": "4AS-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4AS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux AS version 4 Extras",
          "product_id": "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4AS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Desktop version 4 Extras",
          "product_id": "4Desktop-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4Desktop-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Desktop version 4 Extras",
          "product_id": "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4Desktop-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras",
          "product_id": "4ES-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4ES-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux ES version 4 Extras",
          "product_id": "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4ES-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras",
          "product_id": "4WS-LACD:acroread-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4WS-LACD"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "acroread-plugin-0:9.3-1.el4.i386 as a component of Red Hat Enterprise Linux WS version 4 Extras",
          "product_id": "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        },
        "product_reference": "acroread-plugin-0:9.3-1.el4.i386",
        "relates_to_product_reference": "4WS-LACD"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3953",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3954",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a \"DLL-loading vulnerability.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3954",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3954"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3955",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3955",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3955"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3956",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554296"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a \"script injection vulnerability,\" as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: script injection vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "RHBZ#554296",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554296"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3956",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3956"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "acroread: script injection vulnerability (APSB10-02)"
    },
    {
      "cve": "CVE-2009-3959",
      "discovery_date": "2010-01-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "554293"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: multiple code execution flaws (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "RHBZ#554293",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3959"
        }
      ],
      "release_date": "2010-01-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: multiple code execution flaws (APSB10-02)"
    },
    {
      "cve": "CVE-2009-4324",
      "discovery_date": "2009-12-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "547799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-LACD:acroread-0:9.3-1.el4.i386",
          "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
          "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-0:9.3-1.el4.i386",
          "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-0:9.3-1.el4.i386",
          "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "RHBZ#547799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=547799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-4324",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4324"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2009-12-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-01-13T16:08:00+00:00",
          "details": "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network.  Details on how to use\nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0038"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-LACD:acroread-0:9.3-1.el4.i386",
            "4AS-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-0:9.3-1.el4.i386",
            "4Desktop-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-0:9.3-1.el4.i386",
            "4ES-LACD:acroread-plugin-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-0:9.3-1.el4.i386",
            "4WS-LACD:acroread-plugin-0:9.3-1.el4.i386"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-06-08T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "acroread: media.newplayer JavaScript API code execution vulnerability (APSB10-02)"
    }
  ]
}

GSD-2009-3953

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-3953

Aliases

CVE-2009-3953

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-3953",
    "description": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
    "id": "GSD-2009-3953",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-3953.html",
      "https://access.redhat.com/errata/RHSA-2010:0060",
      "https://access.redhat.com/errata/RHSA-2010:0038",
      "https://access.redhat.com/errata/RHSA-2010:0037"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-3953"
      ],
      "details": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
      "id": "GSD-2009-3953",
      "modified": "2023-12-13T01:19:48.871607Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "psirt@adobe.com",
        "ID": "CVE-2009-3953",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl",
            "refsource": "MISC",
            "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
          },
          {
            "name": "38138",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38138"
          },
          {
            "name": "oval:org.mitre.oval:def:8242",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
          },
          {
            "name": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
            "refsource": "CONFIRM",
            "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
          },
          {
            "name": "RHSA-2010:0060",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
          },
          {
            "name": "ADV-2010-0103",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2010/0103"
          },
          {
            "name": "1023446",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id?1023446"
          },
          {
            "name": "61690",
            "refsource": "OSVDB",
            "url": "http://osvdb.org/61690"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=554293",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
          },
          {
            "name": "acrobat-reader-u3d-code-execution(55551)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
          },
          {
            "name": "38215",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/38215"
          },
          {
            "name": "SUSE-SA:2010:008",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
          },
          {
            "name": "TA10-013A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
          },
          {
            "name": "37758",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/37758"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "9.2",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndIncluding": "9.2",
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:unix:unix:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2009-3953"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.adobe.com/support/security/bulletins/apsb10-02.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
            },
            {
              "name": "TA10-013A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
            },
            {
              "name": "ADV-2010-0103",
              "refsource": "VUPEN",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2010/0103"
            },
            {
              "name": "1023446",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id?1023446"
            },
            {
              "name": "SUSE-SA:2010:008",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
            },
            {
              "name": "61690",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://osvdb.org/61690"
            },
            {
              "name": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl",
              "refsource": "MISC",
              "tags": [],
              "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
            },
            {
              "name": "38138",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38138"
            },
            {
              "name": "37758",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/37758"
            },
            {
              "name": "RHSA-2010:0060",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=554293",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
            },
            {
              "name": "38215",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/38215"
            },
            {
              "name": "acrobat-reader-u3d-code-execution(55551)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
            },
            {
              "name": "oval:org.mitre.oval:def:8242",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2018-10-30T16:25Z",
      "publishedDate": "2010-01-13T19:30Z"
    }
  }
}

GHSA-Q4F6-24PH-R6RM

Vulnerability from github – Published: 2022-05-02 03:50 – Updated: 2025-10-22 03:30

Details

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-3953"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-01-13T19:30:00Z",
    "severity": "HIGH"
  },
  "details": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994.",
  "id": "GHSA-q4f6-24ph-r6rm",
  "modified": "2025-10-22T03:30:27Z",
  "published": "2022-05-02T03:50:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3953"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/61690"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/38138"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/38215"
    },
    {
      "type": "WEB",
      "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
    },
    {
      "type": "WEB",
      "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/37758"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1023446"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/0103"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CERTA-2010-AVI-012

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités découvertes dans Adobe Reader et Acrobat permettent à un utilisateur distant d'exécuter du code arbitraire ou de provoquer un déni de service.

Description

De multiples vulnérabilités présentes dans Adobe Reader et Acrobat peuvent être exploitées, au moyen d'un fichier au format PDF spécialement construit, par une personne malveillante afin de provoquer l'arrêt inopiné de l'application ou d'exécuter du code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Adobe	Acrobat	Adobe Reader 9.2 et versions antérieures pour Windows, Macintosh et Unix ;
Adobe	Acrobat	Acrobat 9.2 et versions antérieures pour Windows, Macintosh et Unix ;
Adobe	Acrobat	Adobe Reader 8.1.7 et versions antérieures pour Windows, Macintosh ;
Adobe	Acrobat	Acrobat 8.1.7 et versions antérieures pour Windows, Macintosh.

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe APSB10-02 du 12 janvier 2010	None	vendor-advisory
Bulletin de d'alerte du CERTA CERTA-2009-ALE-023 du 15 décembre 2009 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Reader 9.2 et versions ant\u00e9rieures pour Windows, Macintosh et Unix ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Acrobat 9.2 et versions ant\u00e9rieures pour Windows, Macintosh et Unix ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader 8.1.7 et versions ant\u00e9rieures pour Windows, Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Acrobat 8.1.7 et versions ant\u00e9rieures pour Windows, Macintosh.",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans Adobe Reader et Acrobat\npeuvent \u00eatre exploit\u00e9es, au moyen d\u0027un fichier au format PDF\nsp\u00e9cialement construit, par une personne malveillante afin de provoquer\nl\u0027arr\u00eat inopin\u00e9 de l\u0027application ou d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
    },
    {
      "name": "CVE-2009-4324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
    },
    {
      "name": "CVE-2009-3953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
    },
    {
      "name": "CVE-2009-3955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
    },
    {
      "name": "CVE-2009-3959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
    },
    {
      "name": "CVE-2009-3958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3958"
    },
    {
      "name": "CVE-2009-3957",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3957"
    },
    {
      "name": "CVE-2009-3956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
    }
  ],
  "links": [
    {
      "title": "Bulletin de d\u0027alerte du CERTA CERTA-2009-ALE-023 du 15    d\u00e9cembre 2009 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2009-ALE-023/index.html"
    }
  ],
  "reference": "CERTA-2010-AVI-012",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans Adobe Reader et Acrobat\npermettent \u00e0 un utilisateur distant d\u0027ex\u00e9cuter du code arbitraire ou de\nprovoquer un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Adobe Reader et Acrobat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB10-02 du 12 janvier 2010",
      "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
    }
  ]
}

CERTA-2010-AVI-012

Vulnerability from certfr_avis - Published: - Updated:

Plusieurs vulnérabilités découvertes dans Adobe Reader et Acrobat permettent à un utilisateur distant d'exécuter du code arbitraire ou de provoquer un déni de service.

Description

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Adobe	Acrobat	Adobe Reader 9.2 et versions antérieures pour Windows, Macintosh et Unix ;
Adobe	Acrobat	Acrobat 9.2 et versions antérieures pour Windows, Macintosh et Unix ;
Adobe	Acrobat	Adobe Reader 8.1.7 et versions antérieures pour Windows, Macintosh ;
Adobe	Acrobat	Acrobat 8.1.7 et versions antérieures pour Windows, Macintosh.

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe APSB10-02 du 12 janvier 2010	None	vendor-advisory
Bulletin de d'alerte du CERTA CERTA-2009-ALE-023 du 15 décembre 2009 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Reader 9.2 et versions ant\u00e9rieures pour Windows, Macintosh et Unix ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Acrobat 9.2 et versions ant\u00e9rieures pour Windows, Macintosh et Unix ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader 8.1.7 et versions ant\u00e9rieures pour Windows, Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Acrobat 8.1.7 et versions ant\u00e9rieures pour Windows, Macintosh.",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDe multiples vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans Adobe Reader et Acrobat\npeuvent \u00eatre exploit\u00e9es, au moyen d\u0027un fichier au format PDF\nsp\u00e9cialement construit, par une personne malveillante afin de provoquer\nl\u0027arr\u00eat inopin\u00e9 de l\u0027application ou d\u0027ex\u00e9cuter du code arbitraire \u00e0\ndistance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2009-3954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3954"
    },
    {
      "name": "CVE-2009-4324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-4324"
    },
    {
      "name": "CVE-2009-3953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3953"
    },
    {
      "name": "CVE-2009-3955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3955"
    },
    {
      "name": "CVE-2009-3959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3959"
    },
    {
      "name": "CVE-2009-3958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3958"
    },
    {
      "name": "CVE-2009-3957",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3957"
    },
    {
      "name": "CVE-2009-3956",
      "url": "https://www.cve.org/CVERecord?id=CVE-2009-3956"
    }
  ],
  "links": [
    {
      "title": "Bulletin de d\u0027alerte du CERTA CERTA-2009-ALE-023 du 15    d\u00e9cembre 2009 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2009-ALE-023/index.html"
    }
  ],
  "reference": "CERTA-2010-AVI-012",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-01-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans Adobe Reader et Acrobat\npermettent \u00e0 un utilisateur distant d\u0027ex\u00e9cuter du code arbitraire ou de\nprovoquer un d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Adobe Reader et Acrobat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB10-02 du 12 janvier 2010",
      "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
    }
  ]
}

FKIE_CVE-2009-3953

Vulnerability from fkie_nvd - Published: 2010-01-13 19:30 - Updated: 2025-10-22 01:15

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
psirt@adobe.com	http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	Mailing List, Third Party Advisory
psirt@adobe.com	http://osvdb.org/61690	Broken Link
psirt@adobe.com	http://secunia.com/advisories/38138	Broken Link
psirt@adobe.com	http://secunia.com/advisories/38215	Broken Link
psirt@adobe.com	http://www.adobe.com/support/security/bulletins/apsb10-02.html	Not Applicable, Patch, Vendor Advisory
psirt@adobe.com	http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl	Third Party Advisory
psirt@adobe.com	http://www.redhat.com/support/errata/RHSA-2010-0060.html	Broken Link
psirt@adobe.com	http://www.securityfocus.com/bid/37758	Broken Link, Third Party Advisory, VDB Entry
psirt@adobe.com	http://www.securitytracker.com/id?1023446	Broken Link, Third Party Advisory, VDB Entry
psirt@adobe.com	http://www.us-cert.gov/cas/techalerts/TA10-013A.html	Third Party Advisory, US Government Resource
psirt@adobe.com	http://www.vupen.com/english/advisories/2010/0103	Broken Link, Vendor Advisory
psirt@adobe.com	https://bugzilla.redhat.com/show_bug.cgi?id=554293	Issue Tracking
psirt@adobe.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/55551	Third Party Advisory, VDB Entry
psirt@adobe.com	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/61690	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/38138	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/38215	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.adobe.com/support/security/bulletins/apsb10-02.html	Not Applicable, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2010-0060.html	Broken Link
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/37758	Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id?1023446	Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.us-cert.gov/cas/techalerts/TA10-013A.html	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2010/0103	Broken Link, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.redhat.com/show_bug.cgi?id=554293	Issue Tracking
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/55551	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242	Broken Link
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953

Impacted products

Vendor	Product	Version
adobe	acrobat	*
adobe	acrobat	*
adobe	acrobat	*
apple	mac_os_x	-
microsoft	windows	-
suse	linux_enterprise_debuginfo	11
opensuse	opensuse	11.1
opensuse	opensuse	11.2
suse	linux_enterprise	10.0
suse	linux_enterprise	10.0

JSON

To clipboard

{
  "cisaActionDue": "2022-06-22",
  "cisaExploitAdd": "2022-06-08",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1329474-A9CD-44C3-828C-A0D53418300B",
              "versionEndExcluding": "7.1.4",
              "versionStartIncluding": "7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9670133C-09FA-41F2-B0F7-BFE960E30B71",
              "versionEndExcluding": "8.2",
              "versionStartIncluding": "8.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA95CC75-BF25-4BEB-B646-ACDBBE32AF4F",
              "versionEndExcluding": "9.3",
              "versionStartIncluding": "9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*",
              "matchCriteriaId": "C76D0C17-2AFF-4209-BBCD-36166DF7F974",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBF7B6A8-3DF9-46EC-A90E-6EF68C39F883",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "6A3B50EE-F432-40BE-B422-698955A6058D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "1193A7E6-DCB4-4E79-A509-1D6948153A57",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration \"array boundary issue,\" a different vulnerability than CVE-2009-2994."
    },
    {
      "lang": "es",
      "value": "La implementaci\u00f3n  U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y v8.x anterior a v8.2 sobre Windows y Mac OS X, podr\u00eda permitir a atacantes ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de vectores no especificados, relacionados con una \"cuesti\u00f3n de limitaci\u00f3n en el array\"."
    }
  ],
  "evaluatorImpact": "Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html\r\n\r\nAffected software versions:\r\n\r\nAdobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX\r\nAdobe Acrobat 9.2 and earlier versions for Windows and Macintosh",
  "id": "CVE-2009-3953",
  "lastModified": "2025-10-22T01:15:34.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2010-01-13T19:30:00.343",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link"
      ],
      "url": "http://osvdb.org/61690"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link"
      ],
      "url": "http://secunia.com/advisories/38138"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link"
      ],
      "url": "http://secunia.com/advisories/38215"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Not Applicable",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/37758"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id?1023446"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/0103"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
    },
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Broken Link"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://osvdb.org/61690"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://secunia.com/advisories/38138"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://secunia.com/advisories/38215"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.adobe.com/support/security/bulletins/apsb10-02.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0060.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/37758"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id?1023446"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-013A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/0103"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=554293"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55551"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2009-3953 (GCVE-0-2009-3953)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Affected packages

Description

Impact

Workaround

Resolution

References

Availability

Concerns?

License

Description

Solution

Description

Solution

Tags

Sightings

Nomenclature