CVE-2009-3955
NoneCVSS
—
EPSS
15.8%
Published
Jan 13, 2010
CISA due date
—
The record
Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:rhel_extras:3 | acroread-uninstall | 0 | 0:9.3-3 |
| Red Hat:rhel_extras:4 | acroread | 0 | 0:9.3-1.el4 |
| Red Hat:rhel_extras:4 | acroread-plugin | 0 | 0:9.3-1.el4 |
| Red Hat:rhel_extras:5::client | acroread | 0 | 0:9.3-1.el5 |
| Red Hat:rhel_extras:5::client | acroread-plugin | 0 | 0:9.3-1.el5 |
| Red Hat:rhel_extras:5::server | acroread | 0 | 0:9.3-1.el5 |
| Red Hat:rhel_extras:5::server | acroread-plugin | 0 | 0:9.3-1.el5 |
Related vulnerabilities
- CVE-2009-3959 Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3… Also affects acroread-uninstall
- CVE-2009-3953 The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on… Also affects acroread-uninstall
- CVE-2009-4324 Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe… Also affects acroread-uninstall
- CVE-2011-2462 Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and… Also affects acroread
- CVE-2011-2140 Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before… Also affects acroread
- CVE-2011-2415 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… Also affects acroread
- CVE-2011-2414 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… Also affects acroread
- CVE-2011-2130 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… Also affects acroread