Overview
- Description
- Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- Source
- psirt@adobe.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 9.3
- Impact score
- 10
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:C/I:C/A:C
Known exploits
Data from CISA
- Vulnerability name
- Adobe Acrobat and Reader Use-After-Free Vulnerability
- Exploit added on
- Jun 8, 2022
- Exploit action due
- Jun 22, 2022
- Required action
- Apply updates per vendor instructions.
Weaknesses
- nvd@nist.gov
- CWE-416
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9670133C-09FA-41F2-B0F7-BFE960E30B71",
"versionEndExcluding": "8.2",
"versionStartIncluding": "8.0"
},
{
"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA95CC75-BF25-4BEB-B646-ACDBBE32AF4F",
"versionEndExcluding": "9.3",
"versionStartIncluding": "9.0"
},
{
"criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A8B3441-727A-4A78-A5A4-5A5011075510",
"versionEndExcluding": "8.2",
"versionStartIncluding": "8.0"
},
{
"criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AADB6D5C-5448-4FF7-BB7B-3641EA56194E",
"versionEndExcluding": "9.3",
"versionStartIncluding": "9.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD"
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C76D0C17-2AFF-4209-BBCD-36166DF7F974"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBF7B6A8-3DF9-46EC-A90E-6EF68C39F883"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A3B50EE-F432-40BE-B422-698955A6058D"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1193A7E6-DCB4-4E79-A509-1D6948153A57"
}
],
"operator": "OR"
}
]
}
]