Vulnerability Details : CVE-2009-3959
Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.
Vulnerability category: OverflowExecute code
Products affected by CVE-2009-3959
- cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-3959
16.20%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-3959
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
CWE ids for CVE-2009-3959
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3959
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8539
-
http://www.securityfocus.com/archive/1/508949
-
http://www.securityfocus.com/bid/37756
-
http://www.redhat.com/support/errata/RHSA-2010-0060.html
Support
-
http://www.vupen.com/english/advisories/2010/0103
Vendor Advisory
-
http://www.adobe.com/support/security/bulletins/apsb10-02.html
Adobe - Security Bulletin APSB10-02 Security updates available for Adobe Reader and AcrobatPatch;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/55557
-
http://www.us-cert.gov/cas/techalerts/TA10-013A.html
US Government Resource
-
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
[security-announce] SUSE Security Announcement: acoread (SUSE-SA:2010:00
-
http://secunia.com/advisories/38215
About Secunia Research | Flexera
-
https://bugzilla.redhat.com/show_bug.cgi?id=554293
554293 – (CVE-2009-3953, CVE-2009-3954, CVE-2009-3955, CVE-2009-3958, CVE-2009-3959) CVE-2009-3953 CVE-2009-3954 CVE-2009-3955 CVE-2009-3959 acroread: multiple code execution flaws (APSB10-02)
-
http://www.securitytracker.com/id?1023446
Access Denied
-
http://secunia.com/advisories/38138
Jump to