Adobe · Reader and Acrobat
CVE-2009-0927
Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability
Qué es
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.
CISA: Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 15 de abril de 2022
- Añadida a la lista de CISA
- 25 de marzo de 2022
- Publicada
- 19 de marzo de 2009
- Gravedad
- Alto 8,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 97% entre el 0,1% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-20
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (16)
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1
- http://security.gentoo.org/glsa/glsa-200904-17.xml
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
- http://www.zerodayinitiative.com/advisories/ZDI-09-014
- http://www.exploit-db.com/exploits/9579
- http://www.securityfocus.com/bid/34169
- http://secunia.com/advisories/34790
- http://www.adobe.com/support/security/bulletins/apsb09-04.html
- http://www.securitytracker.com/id?1021861
- http://www.vupen.com/english/advisories/2009/0770
- http://secunia.com/advisories/34490
- http://www.securityfocus.com/archive/1/502116/100/0/threaded
- http://secunia.com/advisories/34706
- http://www.vupen.com/english/advisories/2009/1019
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49312
Más fallos explotados de Adobe
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 8 jun 2022 | Universal 3D Memory Corruption | Reader and Acrobat | Alto 8,8 | 89% |
| 25 may 2022 | Sandbox Bypass | Reader and Acrobat | Alto 8,8 | 22% |
| 28 mar 2022 | Arbitrary Integer Overflow | Reader and Acrobat | Alto 8,8 | 67% |
| 3 mar 2022 | Arbitrary Code Execution | Reader and Acrobat | Alto 7,8 | 88% |
| 3 mar 2022 | Memory Corruption | Reader and Acrobat | Alto 7,8 | 87% |
| 3 mar 2022 | Memory Corruption | Reader and Acrobat | Alto 8,8 | 79% |
| 3 mar 2022 | Use-After-Free | Reader and Acrobat | Alto 8,8 | 40% |
| 27 oct 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Crítica 9,3 | 31% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.