NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2009-3953

Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-08. Federal due date: 2022-06-22.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

Affected products

VendorProductAffected versions
AdobeAcrobat
from 7.0 before 7.1.4
from 8.0 before 8.2
from 9.0 before 9.3
SuseLinux Enterprise Debuginfo
Version 11
OpensuseOpensuse
Versions 11.1, 11.2
SuseLinux Enterprise
Version 10.0

Weakness classification

CWE-787

References