Adobe · Acrobat and Reader
CVE-2009-4324
Adobe Acrobat and Reader Use-After-Free Vulnerability
Nedir
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
CISA: Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 22 Haziran 2022
- CISA listesine eklenme
- 8 Haziran 2022
- Yayımlanma
- 15 Aralık 2009
- Önem
- Yüksek 7,8 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 82% bilinen tüm açıkların en üstteki 0,4% diliminde
- Zayıflık
- CWE-399
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (20)
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://www.securityfocus.com/bid/37331
- http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
- http://secunia.com/advisories/37690
- http://secunia.com/advisories/38138
- https://bugzilla.redhat.com/show_bug.cgi?id=547799
- http://osvdb.org/60980
- http://www.kb.cert.org/vuls/id/508357
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54747
- http://www.vupen.com/english/advisories/2009/3518
- http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows…
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795
- http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html
- http://www.vupen.com/english/advisories/2010/0103
- http://www.adobe.com/support/security/advisories/apsa09-07.html
- http://www.symantec.com/connect/blogs/zero-day-xmas-present
- http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214
- http://secunia.com/advisories/38215
Adobe için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 20 May 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | Yüksek 8,8 | 87% |
| 13 Nis 2026 | Prototype Pollution | Acrobat and Reader | Yüksek 8,6 | 7,2% |
| 10 Eki 2023 | Use-After-Free | Acrobat and Reader | Yüksek 7,8 | 59% |
| 14 Eyl 2023 | Out-of-Bounds Write | Acrobat and Reader | Yüksek 7,8 | 6,7% |
| 8 Haz 2022 | Buffer Overflow | Acrobat and Reader | Yüksek 7,8 | 87% |
| 8 Haz 2022 | Unspecified | Acrobat and Reader | Yüksek 8,8 | 38% |
| 8 Haz 2022 | Universal 3D Remote Code Execution | Acrobat and Reader | Yüksek 8,8 | 83% |
| 8 Haz 2022 | Stack-Based Buffer Overflow | Acrobat and Reader | Yüksek 7,3 | 81% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.