high7.8Known exploitedPublic exploit code
CVE-2009-4324
Adobe Acrobat and Reader Use-After-Free Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-08. Federal due date: 2022-06-22.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2)2010-09-25 · local · windows · Verified
- Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1)2010-04-30 · local · windows · Verified
- Adobe Reader / Acrobat - '.PDF' File Overflow2009-12-23 · local · windows · Verified
Impact
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Acrobat | from 8.0 before 8.2 from 9.0 before 9.3 |
| Adobe | Acrobat Reader | from 8.0 before 8.2 from 9.0 before 9.3 |
| Suse | Linux Enterprise Debuginfo | Version 11 |
| Opensuse | Opensuse | Versions 11.1, 11.2 |
| Suse | Linux Enterprise | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
- http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://osvdb.org/60980
- http://secunia.com/advisories/37690
- http://secunia.com/advisories/38138
- http://secunia.com/advisories/38215
- http://www.adobe.com/support/security/advisories/apsa09-07.html
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- http://www.kb.cert.org/vuls/id/508357
- http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb
- http://www.redhat.com/support/errata/RHSA-2010-0060.html
- http://www.securityfocus.com/bid/37331
- http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214
- http://www.symantec.com/connect/blogs/zero-day-xmas-present
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html
- http://www.vupen.com/english/advisories/2009/3518
- http://www.vupen.com/english/advisories/2010/0103
- https://bugzilla.redhat.com/show_bug.cgi?id=547799
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54747
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795
- http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
- http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
- http://osvdb.org/60980