CVE-2009-1493
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 21.8%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 21.83% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- adobe/reader
- Source
- cve@mitre.org
References
- http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.htmlVendor Advisory
- http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlMailing List, Third Party Advisory
- http://osvdb.org/54129Broken Link
- http://packetstorm.linuxsecurity.com/0904-exploits/spell.txtExploit
- http://secunia.com/advisories/34924Broken Link
- http://secunia.com/advisories/35055Broken Link
- http://secunia.com/advisories/35096Broken Link
- http://secunia.com/advisories/35152Broken Link
- http://secunia.com/advisories/35358Broken Link
- http://secunia.com/advisories/35416Broken Link
- http://secunia.com/advisories/35734Broken Link
- http://security.gentoo.org/glsa/glsa-200907-06.xmlThird Party Advisory
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1Broken Link
- http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953Third Party Advisory
- http://www.adobe.com/support/security/bulletins/apsb09-06.htmlThird Party Advisory
- http://www.kb.cert.org/vuls/id/970180Third Party Advisory, US Government Resource
- http://www.redhat.com/support/errata/RHSA-2009-0478.htmlThird Party Advisory
- http://www.securityfocus.com/bid/34740Exploit, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1022139Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA09-133B.htmlThird Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2009/1189Broken Link
- http://www.vupen.com/english/advisories/2009/1317Broken Link
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50146Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/8570Third Party Advisory, VDB Entry
- http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.htmlVendor Advisory
- http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlMailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.