CVE-2009-3459: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
In CISA’s Known Exploited Vulnerabilities catalog: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information.
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
Adobe: Acrobat and Reader
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html (opens in new tab)
- isc.sans.org/diary.html (opens in new tab)
- secunia.com/advisories/36983 (opens in new tab)
- securitytracker.com/id (opens in new tab)
- exchange.xforce.ibmcloud.com/vulnerabilities/53691 (opens in new tab)
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534 (opens in new tab)
- www.adobe.com/support/security/bulletins/apsb09-15.html (opens in new tab)
- www.iss.net/threats/348.html (opens in new tab)
- www.securityfocus.com/bid/36600 (opens in new tab)
- www.us-cert.gov/cas/techalerts/TA09-286B.html (opens in new tab)
- www.vupen.com/english/advisories/2009/2851 (opens in new tab)
- www.vupen.com/english/advisories/2009/2898 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)