CVE-2009-4002: Buffer Overflow
Published Jan 21, 2010
·Updated
Heap-based buffer overflow in Adobe Shockwave Player before 11.5.6.606 allows remote attackers to execute arbitrary code via a crafted 3D model in a Shockwave file.
Affected Software
15 affected components
Adobe Shockwave Player=5.0
Adobe Shockwave Player=4.0
Adobe Shockwave Player=8.5.1
Adobe Shockwave Player=11.5.1.601
Adobe Shockwave Player=11.0.0.456
Adobe Shockwave Player=6.0
Adobe Shockwave Player=10.1.0.11
Adobe Shockwave Player=11.5.0.596
Adobe Shockwave Player=1.0
Adobe Shockwave Player=2.0
Adobe Shockwave Player=8.0
Adobe Shockwave Player<=11.5.2.602
Adobe Shockwave Player=3.0
Adobe Shockwave Player=11.5.0.595
Adobe Shockwave Player=9
Remediation
Patch Available
Event History
Jan 21, 2010
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-4002?
CVE-2009-4002 is classified as a critical vulnerability that can allow remote attackers to execute arbitrary code.
2
How do I fix CVE-2009-4002?
To fix CVE-2009-4002, update Adobe Shockwave Player to version 11.5.6.606 or later.
3
What are the affected versions in CVE-2009-4002?
CVE-2009-4002 affects multiple versions of Adobe Shockwave Player, including versions 1.0 through 11.5.2.602.
4
How does CVE-2009-4002 exploit occur?
CVE-2009-4002 exploits a heap-based buffer overflow vulnerability triggered by a crafted 3D model in a Shockwave file.
5
Who is impacted by CVE-2009-4002?
Users of vulnerable versions of Adobe Shockwave Player, especially those who load untrusted Shockwave files, are at risk from CVE-2009-4002.