جزئیات آسیب‌پذیری

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

• http://www.securityfocus.com/bid/37331 vdb-entryx_refsource_BID
• http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html x_refsource_MISC
• http://secunia.com/advisories/37690 third-party-advisoryx_refsource_SECUNIA
• http://secunia.com/advisories/38138 third-party-advisoryx_refsource_SECUNIA
• https://bugzilla.redhat.com/show_bug.cgi?id=547799 x_refsource_CONFIRM
• http://osvdb.org/60980 vdb-entryx_refsource_OSVDB
• http://www.kb.cert.org/vuls/id/508357 third-party-advisoryx_refsource_CERT-VN
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54747 vdb-entryx_refsource_XF
• http://www.vupen.com/english/advisories/2009/3518 vdb-entryx_refsource_VUPEN
• http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb x_refsource_MISC
• http://www.adobe.com/support/security/bulletins/apsb10-02.html x_refsource_CONFIRM
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795 vdb-entrysignaturex_refsource_OVAL
• http://www.redhat.com/support/errata/RHSA-2010-0060.html vendor-advisoryx_refsource_REDHAT
• http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html x_refsource_MISC
• http://www.vupen.com/english/advisories/2010/0103 vdb-entryx_refsource_VUPEN
• http://www.adobe.com/support/security/advisories/apsa09-07.html x_refsource_CONFIRM
• http://www.symantec.com/connect/blogs/zero-day-xmas-present x_refsource_MISC
• http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214 x_refsource_MISC
• http://secunia.com/advisories/38215 third-party-advisoryx_refsource_SECUNIA
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html vendor-advisoryx_refsource_SUSE
• http://www.us-cert.gov/cas/techalerts/TA10-013A.html third-party-advisoryx_refsource_CERT
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324 government-resource