CVE-2009-3953

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-3953
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html Mailing List Third Party Advisory
http://osvdb.org/61690 Broken Link
http://secunia.com/advisories/38138 Broken Link
http://secunia.com/advisories/38215 Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-02.html Not Applicable Patch Vendor Advisory
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html Broken Link
http://www.securityfocus.com/bid/37758 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1023446 Broken Link Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA10-013A.html Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2010/0103 Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293 Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html Mailing List Third Party Advisory
http://osvdb.org/61690 Broken Link
http://secunia.com/advisories/38138 Broken Link
http://secunia.com/advisories/38215 Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-02.html Not Applicable Patch Vendor Advisory
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html Broken Link
http://www.securityfocus.com/bid/37758 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1023446 Broken Link Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA10-013A.html Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2010/0103 Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293 Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 Broken Link
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*
History

21 Nov 2024, 01:08

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html - Mailing List, Third Party Advisory
References () http://osvdb.org/61690 - Broken Link () http://osvdb.org/61690 - Broken Link
References () http://secunia.com/advisories/38138 - Broken Link () http://secunia.com/advisories/38138 - Broken Link
References () http://secunia.com/advisories/38215 - Broken Link () http://secunia.com/advisories/38215 - Broken Link
References () http://www.adobe.com/support/security/bulletins/apsb10-02.html - Not Applicable, Patch, Vendor Advisory () http://www.adobe.com/support/security/bulletins/apsb10-02.html - Not Applicable, Patch, Vendor Advisory
References () http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl - Third Party Advisory () http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl - Third Party Advisory
References () http://www.redhat.com/support/errata/RHSA-2010-0060.html - Broken Link () http://www.redhat.com/support/errata/RHSA-2010-0060.html - Broken Link
References () http://www.securityfocus.com/bid/37758 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/37758 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id?1023446 - Broken Link, Third Party Advisory, VDB Entry () http://www.securitytracker.com/id?1023446 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.us-cert.gov/cas/techalerts/TA10-013A.html - Third Party Advisory, US Government Resource () http://www.us-cert.gov/cas/techalerts/TA10-013A.html - Third Party Advisory, US Government Resource
References () http://www.vupen.com/english/advisories/2010/0103 - Broken Link, Vendor Advisory () http://www.vupen.com/english/advisories/2010/0103 - Broken Link, Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=554293 - Issue Tracking () https://bugzilla.redhat.com/show_bug.cgi?id=554293 - Issue Tracking
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 - Third Party Advisory, VDB Entry () https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 - Third Party Advisory, VDB Entry
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 - Broken Link () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 - Broken Link

28 Jun 2024, 14:20

Type Values Removed Values Added
First Time Opensuse opensuse
Suse linux Enterprise Debuginfo
Suse
Suse linux Enterprise
Opensuse
CPE cpe:2.3:a:adobe:acrobat_reader:7.1.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*
cpe:2.3:o:unix:unix:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.1.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:3.01:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1.7:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:3.02:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:7.1.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*		 cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
References () http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html - () http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html - Mailing List, Third Party Advisory
References () http://osvdb.org/61690 - () http://osvdb.org/61690 - Broken Link
References () http://secunia.com/advisories/38138 - () http://secunia.com/advisories/38138 - Broken Link
References () http://secunia.com/advisories/38215 - () http://secunia.com/advisories/38215 - Broken Link
References () http://www.adobe.com/support/security/bulletins/apsb10-02.html - Patch, Vendor Advisory () http://www.adobe.com/support/security/bulletins/apsb10-02.html - Not Applicable, Patch, Vendor Advisory
References () http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl - () http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl - Third Party Advisory
References () http://www.redhat.com/support/errata/RHSA-2010-0060.html - () http://www.redhat.com/support/errata/RHSA-2010-0060.html - Broken Link
References () http://www.securityfocus.com/bid/37758 - () http://www.securityfocus.com/bid/37758 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id?1023446 - () http://www.securitytracker.com/id?1023446 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.us-cert.gov/cas/techalerts/TA10-013A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA10-013A.html - Third Party Advisory, US Government Resource
References () http://www.vupen.com/english/advisories/2010/0103 - Vendor Advisory () http://www.vupen.com/english/advisories/2010/0103 - Broken Link, Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=554293 - () https://bugzilla.redhat.com/show_bug.cgi?id=554293 - Issue Tracking
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/55551 - Third Party Advisory, VDB Entry
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242 - Broken Link
CVSS v2 : 10.0
v3 : unknown 		v2 : 10.0
v3 : 8.8
CWE CWE-119 CWE-787
Information

Published : 2010-01-13 19:30

Updated : 2024-11-21 01:08

NVD link : CVE-2009-3953

Mitre link : CVE-2009-3953

CVE.ORG link : CVE-2009-3953

JSON object : View

Products Affected

microsoft

  • windows

suse

  • linux_enterprise_debuginfo
  • linux_enterprise

opensuse

  • opensuse

adobe

  • acrobat

apple

  • mac_os_x
CWE
CWE-787

Out-of-bounds Write