CVE-2009-0520
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 28.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 28.48% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- adobe/air · adobe/flash player · adobe/flash player for linux · adobe/flex
- Source
- cve@mitre.org
References
- http://isc.sans.org/diary.html?storyid=5929Patch
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2009-0332.html
- http://rhn.redhat.com/errata/RHSA-2009-0334.html
- http://secunia.com/advisories/34012
- http://secunia.com/advisories/34226
- http://secunia.com/advisories/34293
- http://secunia.com/advisories/35074
- http://security.gentoo.org/glsa/glsa-200903-23.xml
- http://securitytracker.com/id?1021750
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-254909-1
- http://support.apple.com/kb/HT3549
- http://www.adobe.com/support/security/bulletins/apsb09-01.htmlPatch, Vendor Advisory
- http://www.securityfocus.com/bid/33880Patch
- http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2009/0513Patch
- http://www.vupen.com/english/advisories/2009/0743
- http://www.vupen.com/english/advisories/2009/1297
- https://bugzilla.redhat.com/show_bug.cgi?id=487142
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48887
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16057
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6593
- http://isc.sans.org/diary.html?storyid=5929Patch
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2009-0332.html
- http://rhn.redhat.com/errata/RHSA-2009-0334.html
- http://secunia.com/advisories/34012
- http://secunia.com/advisories/34226
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.