CVE-2009-3955: Critical severity adobe acrobat reader vulnerability

Q: What is the severity of CVE-2009-3955?

CVE-2009-3955 is rated as a critical vulnerability due to its potential to allow remote code execution.

Q: How do I fix CVE-2009-3955?

To fix CVE-2009-3955, users should update Adobe Reader and Acrobat to version 9.3 or higher.

Q: Which versions of Adobe products are affected by CVE-2009-3955?

CVE-2009-3955 affects Adobe Reader and Acrobat 9.x before 9.3 and 8.x before 8.2.

Q: What platforms are impacted by CVE-2009-3955?

CVE-2009-3955 affects versions of Adobe Reader and Acrobat on both Windows and Mac OS X.

Q: Can CVE-2009-3955 be exploited remotely?

Yes, CVE-2009-3955 can be exploited remotely through a crafted JPC_MS_RGN marker within a manipulated Jp2c stream.

Published Jan 12, 2010

Updated

Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPCMSRGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.

Affected Software

101 affected componentsFixes available

redhat/acroread<0:9.3-1.el4

0:9.3-1.el4

redhat/acroread<0:9.3-1.el5

0:9.3-1.el5

Adobe Acrobat<=9.2

Adobe Acrobat=3.0

Adobe Acrobat=3.1

Adobe Acrobat=4.0

Adobe Acrobat=4.0.5

Adobe Acrobat=4.0.5a

Adobe Acrobat=4.0.5c

Adobe Acrobat=5.0

Adobe Acrobat=5.0.5

Adobe Acrobat=5.0.6

Adobe Acrobat=5.0.10

Adobe Acrobat=6.0

Adobe Acrobat=6.0.1

Adobe Acrobat=6.0.2

Adobe Acrobat=6.0.3

Adobe Acrobat=6.0.4

Adobe Acrobat=6.0.5

Adobe Acrobat=6.0.6

Adobe Acrobat=7.0

Adobe Acrobat=7.0.1

Adobe Acrobat=7.0.2

Adobe Acrobat=7.0.3

Adobe Acrobat=7.0.4

Adobe Acrobat=7.0.5

Adobe Acrobat=7.0.6

Adobe Acrobat=7.0.7

Adobe Acrobat=7.0.8

Adobe Acrobat=7.0.9

Adobe Acrobat=7.1.0

Adobe Acrobat=7.1.1

Adobe Acrobat=7.1.2

Adobe Acrobat=7.1.3

Adobe Acrobat=7.1.4

Adobe Acrobat=8.0

Adobe Acrobat=8.1

Adobe Acrobat=8.1.1

Adobe Acrobat=8.1.2

Adobe Acrobat=8.1.3

Adobe Acrobat=8.1.4

Adobe Acrobat=8.1.5

Adobe Acrobat=8.1.6

Adobe Acrobat=8.1.7

Adobe Acrobat=9.0

Adobe Acrobat=9.1

Adobe Acrobat=9.1.1

Adobe Acrobat=9.1.2

Adobe Acrobat=9.1.3

Apple iOS and macOS

Microsoft Windows

Adobe Acrobat Reader<=9.2

Adobe Acrobat Reader=3.0

Adobe Acrobat Reader=3.01

Adobe Acrobat Reader=3.02

Adobe Acrobat Reader=4.0

Adobe Acrobat Reader=4.0.5

Adobe Acrobat Reader=4.0.5a

Adobe Acrobat Reader=4.0.5c

Adobe Acrobat Reader=4.5

Adobe Acrobat Reader=5.0

Adobe Acrobat Reader=5.0.5

Adobe Acrobat Reader=5.0.6

Adobe Acrobat Reader=5.0.7

Adobe Acrobat Reader=5.0.9

Adobe Acrobat Reader=5.0.10

Adobe Acrobat Reader=5.0.11

Adobe Acrobat Reader=5.1

Adobe Acrobat Reader=6.0

Adobe Acrobat Reader=6.0.1

Adobe Acrobat Reader=6.0.2

Adobe Acrobat Reader=6.0.3

Adobe Acrobat Reader=6.0.4

Adobe Acrobat Reader=6.0.5

Adobe Acrobat Reader=7.0

Adobe Acrobat Reader=7.0.1

Adobe Acrobat Reader=7.0.2

Adobe Acrobat Reader=7.0.3

Adobe Acrobat Reader=7.0.4

Adobe Acrobat Reader=7.0.5

Adobe Acrobat Reader=7.0.6

Adobe Acrobat Reader=7.0.7

Adobe Acrobat Reader=7.0.8

Adobe Acrobat Reader=7.0.9

Adobe Acrobat Reader=7.1.0

Adobe Acrobat Reader=7.1.1

Adobe Acrobat Reader=7.1.2

Adobe Acrobat Reader=7.1.3

Adobe Acrobat Reader=8.0

Adobe Acrobat Reader=8.1

Adobe Acrobat Reader=8.1.1

Adobe Acrobat Reader=8.1.2

Adobe Acrobat Reader=8.1.4

Adobe Acrobat Reader=8.1.5

Adobe Acrobat Reader=8.1.6

Adobe Acrobat Reader=8.1.7

Adobe Acrobat Reader=9.0

Adobe Acrobat Reader=9.1

Adobe Acrobat Reader=9.1.1

Adobe Acrobat Reader=9.1.2

Adobe Acrobat Reader=9.1.3

Remediation

Patch Available

http://www.adobe.com/support/security/bulletins/apsb10-02.html

Event History

Jan 12, 2010

CVE Published

via Red Hat·12:00 AM

Jan 13, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

07:30 PM

DescriptionWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2009-3955?