CVE-2009-3955
Published · Updated
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 16%
exploitation probability
16%top 3% of all CVEs
observed exploitation
nono source reports it
Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.
Affected products
n/a · n/aReferences
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=836http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=554293http://secunia.com/advisories/38138http://secunia.com/advisories/38215https://exchange.xforce.ibmcloud.com/vulnerabilities/55553https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8255http://www.adobe.com/support/security/bulletins/apsb10-02.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0060.htmlhttp://www.securityfocus.com/bid/37757http://www.securitytracker.com/id?1023446http://www.us-cert.gov/cas/techalerts/TA10-013A.html