CVE-2009-4324
High · 7.8 CISA KEVCVSS
7.8
EPSS
81.9%
Published
Dec 15, 2009
CISA due date
Jun 22, 2022
The record
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Red Hat:rhel_extras:3 | acroread-uninstall | 0 | 0:9.3-3 |
| Red Hat:rhel_extras:4 | acroread | 0 | 0:9.3-1.el4 |
| Red Hat:rhel_extras:4 | acroread-plugin | 0 | 0:9.3-1.el4 |
| Red Hat:rhel_extras:5::client | acroread | 0 | 0:9.3-1.el5 |
| Red Hat:rhel_extras:5::client | acroread-plugin | 0 | 0:9.3-1.el5 |
| Red Hat:rhel_extras:5::server | acroread | 0 | 0:9.3-1.el5 |
| Red Hat:rhel_extras:5::server | acroread-plugin | 0 | 0:9.3-1.el5 |
Related vulnerabilities
- CVE-2009-3955 Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X… Also affects acroread-uninstall
- CVE-2009-3959 Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3… Also affects acroread-uninstall
- CVE-2009-3953 The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on… Also affects acroread-uninstall
- CVE-2011-2462 Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and… Also affects acroread
- CVE-2011-2140 Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before… Also affects acroread
- CVE-2011-2415 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… Also affects acroread
- CVE-2011-2414 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… Also affects acroread
- CVE-2011-2130 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… Also affects acroread