Adobe · Acrobat and Reader
CVE-2009-3459
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
概要
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
CISA: Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
対処法
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
米国連邦機関の対応期限：2026年6月3日
- CISAのリストに追加
- 2026年5月20日
- 公開日
- 2009年10月13日
- 深刻度
- 高 8.8 CVSS 3.1
- 今後30日間に攻撃される可能性（EPSS）
- 87% 既知の全脆弱性の上位0.3%
- 脆弱性の種類
- CWE-119
- 詳細
- NVD · CVE.org · CISA
すべての参照（12件）
- http://secunia.com/advisories/36983
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534
- http://www.us-cert.gov/cas/techalerts/TA09-286B.html
- http://securitytracker.com/id?1023007
- http://www.adobe.com/support/security/bulletins/apsb09-15.html
- http://www.iss.net/threats/348.html
- http://www.vupen.com/english/advisories/2009/2851
- http://isc.sans.org/diary.html?storyid=7300
- http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html
- http://www.securityfocus.com/bid/36600
- http://www.vupen.com/english/advisories/2009/2898
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53691
Adobeのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/04/13 | Prototype Pollution | Acrobat and Reader | 高 8.6 | 7.3% |
| 2023/10/10 | Use-After-Free | Acrobat and Reader | 高 7.8 | 59% |
| 2023/09/14 | Out-of-Bounds Write | Acrobat and Reader | 高 7.8 | 7.5% |
| 2022/06/08 | Buffer Overflow | Acrobat and Reader | 高 7.8 | 87% |
| 2022/06/08 | Unspecified | Acrobat and Reader | 高 8.8 | 38% |
| 2022/06/08 | Universal 3D Remote Code Execution | Acrobat and Reader | 高 8.8 | 83% |
| 2022/06/08 | Use-After-Free | Acrobat and Reader | 高 7.8 | 82% |
| 2022/06/08 | Stack-Based Buffer Overflow | Acrobat and Reader | 高 7.3 | 81% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。