Veille CVE
CVE-2009-3953
8.8 Élevée Exploitée activementCatalogue CISA KEV — Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability
Ajoutée le 08/06/2022 · Échéance de correction (agences US) : 22/06/2022
Action requise : Apply updates per vendor instructions.
Description
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | 10.0 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html Mailing ListThird Party Advisory
- http://osvdb.org/61690 Broken Link
- http://secunia.com/advisories/38138 Broken Link
- http://secunia.com/advisories/38215 Broken Link
- http://www.adobe.com/support/security/bulletins/apsb10-02.html Not ApplicablePatchVendor Advisory
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0060.html Broken Link
- http://www.securityfocus.com/bid/37758 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1023446 Broken LinkThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html Third Party AdvisoryUS Government Resource
- http://www.vupen.com/english/advisories/2010/0103 Broken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=554293 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 Third Party AdvisoryVDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html Mailing ListThird Party Advisory
- http://osvdb.org/61690 Broken Link
- http://secunia.com/advisories/38138 Broken Link
- http://secunia.com/advisories/38215 Broken Link
- http://www.adobe.com/support/security/bulletins/apsb10-02.html Not ApplicablePatchVendor Advisory
- http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl Third Party Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0060.html Broken Link
- http://www.securityfocus.com/bid/37758 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id?1023446 Broken LinkThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA10-013A.html Third Party AdvisoryUS Government Resource
- http://www.vupen.com/english/advisories/2010/0103 Broken LinkVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=554293 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 Third Party AdvisoryVDB Entry
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953 US Government Resource