Adobe · Acrobat and Reader
CVE-2009-3953
Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Qué es
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
CISA: Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 22 de junio de 2022
- Añadida a la lista de CISA
- 8 de junio de 2022
- Publicada
- 13 de enero de 2010
- Gravedad
- Alto 8,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 83% entre el 0,3% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-119
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (14)
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
- http://secunia.com/advisories/38138
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- http://www.vupen.com/english/advisories/2010/0103
- http://www.securitytracker.com/id?1023446
- http://osvdb.org/61690
- https://bugzilla.redhat.com/show_bug.cgi?id=554293
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55551
- http://secunia.com/advisories/38215
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html
- http://www.securityfocus.com/bid/37758
Más fallos explotados de Adobe
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 20 may 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | Alto 8,8 | 87% |
| 13 abr 2026 | Prototype Pollution | Acrobat and Reader | Alto 8,6 | 7,2% |
| 10 oct 2023 | Use-After-Free | Acrobat and Reader | Alto 7,8 | 59% |
| 14 sept 2023 | Out-of-Bounds Write | Acrobat and Reader | Alto 7,8 | 6,7% |
| 8 jun 2022 | Buffer Overflow | Acrobat and Reader | Alto 7,8 | 87% |
| 8 jun 2022 | Unspecified | Acrobat and Reader | Alto 8,8 | 38% |
| 8 jun 2022 | Use-After-Free | Acrobat and Reader | Alto 7,8 | 82% |
| 8 jun 2022 | Stack-Based Buffer Overflow | Acrobat and Reader | Alto 7,3 | 81% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.