Adobe · Acrobat and Reader
CVE-2009-4324
Adobe Acrobat and Reader Use-After-Free Vulnerability
Qué es
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
CISA: Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 22 de junio de 2022
- Añadida a la lista de CISA
- 8 de junio de 2022
- Publicada
- 15 de diciembre de 2009
- Gravedad
- Alto 7,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 82% entre el 0,4% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-399
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (20)
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://www.securityfocus.com/bid/37331
- http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
- http://secunia.com/advisories/37690
- http://secunia.com/advisories/38138
- https://bugzilla.redhat.com/show_bug.cgi?id=547799
- http://osvdb.org/60980
- http://www.kb.cert.org/vuls/id/508357
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54747
- http://www.vupen.com/english/advisories/2009/3518
- http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows…
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795
- http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html
- http://www.vupen.com/english/advisories/2010/0103
- http://www.adobe.com/support/security/advisories/apsa09-07.html
- http://www.symantec.com/connect/blogs/zero-day-xmas-present
- http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214
- http://secunia.com/advisories/38215
Más fallos explotados de Adobe
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 20 may 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | Alto 8,8 | 87% |
| 13 abr 2026 | Prototype Pollution | Acrobat and Reader | Alto 8,6 | 7,2% |
| 10 oct 2023 | Use-After-Free | Acrobat and Reader | Alto 7,8 | 59% |
| 14 sept 2023 | Out-of-Bounds Write | Acrobat and Reader | Alto 7,8 | 6,7% |
| 8 jun 2022 | Buffer Overflow | Acrobat and Reader | Alto 7,8 | 87% |
| 8 jun 2022 | Unspecified | Acrobat and Reader | Alto 8,8 | 38% |
| 8 jun 2022 | Universal 3D Remote Code Execution | Acrobat and Reader | Alto 8,8 | 83% |
| 8 jun 2022 | Stack-Based Buffer Overflow | Acrobat and Reader | Alto 7,3 | 81% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.