CVE-2009-3953

Опубликовано: 13 янв. 2010

Источник: nvd

CVSS3: 8.8

CVSS2: 10

EPSS Критический

Описание

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
Mailing List
Third Party Advisory
http://osvdb.org/61690
Broken Link
http://secunia.com/advisories/38138
Broken Link
http://secunia.com/advisories/38215
Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-02.html
Not Applicable
Patch
Vendor Advisory
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html
Broken Link
http://www.securityfocus.com/bid/37758
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1023446
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA10-013A.html
Third Party Advisory
US Government Resource
http://www.vupen.com/english/advisories/2010/0103
Broken Link
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/55551
Third Party Advisory
VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
Mailing List
Third Party Advisory
http://osvdb.org/61690
Broken Link
http://secunia.com/advisories/38138
Broken Link
http://secunia.com/advisories/38215
Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-02.html
Not Applicable
Patch
Vendor Advisory
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Версия от 7.0 (включая) до 7.1.4 (исключая)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Версия от 8.0 (включая) до 8.2 (исключая)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Версия от 9.0 (включая) до 9.3 (исключая)

Одно из

cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.90514

Критический

8.8 High

CVSS3

10 Critical

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2009-3953

redhat

около 16 лет назад

GHSA-q4f6-24ph-r6rm

CVSS3: 8.8

github

почти 4 года назад

EPSS

Процентиль: 100%

0.90514

Критический

8.8 High

CVSS3

10 Critical

CVSS2

Дефекты

CWE-787