CVE-2009-1862

high-risk
Published 2009-07-23

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Do I need to act?

!
58.6% chance of exploitation in next 30 days
EPSS score — higher than 41% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (3)

Affected Vendors

Adobe

References (41)

Broken Link http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html
Broken Link http://bugs.adobe.com/jira/browse/FP-1265
Not Applicable http://isc.sans.org/diary.html?storyid=6847
Mailing List http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html
Mailing List http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
Broken Link http://news.cnet.com/8301-27080_3-10293389-245.html
Broken Link http://secunia.com/advisories/36193
Broken Link http://secunia.com/advisories/36374
Broken Link http://secunia.com/advisories/36701
Third Party Advisory http://security.gentoo.org/glsa/glsa-200908-04.xml
Broken Link http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1
Third Party Advisory http://support.apple.com/kb/HT3864
Third Party Advisory http://support.apple.com/kb/HT3865
Vendor Advisory http://www.adobe.com/support/security/advisories/apsa09-03.html
Not Applicable http://www.adobe.com/support/security/bulletins/apsb09-10.html
Not Applicable http://www.adobe.com/support/security/bulletins/apsb09-13.html
Third Party Advisory http://www.kb.cert.org/vuls/id/259425
Broken Link http://www.securityfocus.com/bid/35759
Broken Link http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209...
Broken Link http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability
and 21 more references
58
/ 100
high-risk
Severity 24/34 · High
Exploitability 25/34 · High
Exposure 9/34 · Low