The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4324 to the following vulnerability:

Name: CVE-2009-4324 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324 Assigned: 20091214 Reference: MISC: http://blogs.adobe.com/psirt/2009/12/newadobereaderandacrobatv.html

Unspecified vulnerability in Adobe Reader and Acrobat 9.2 and earlier has unknown impact and attack vectors, as exploited in the wild in December 2009.

An unconfirmed third-party posting [1] indicates this vulnerability is in the JavaScript processing, so a proposed work-around is to disable JavaScript (Edit -> Preferences -> JavaScript). This has not been official confirmed by Adobe.

[1] http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214

Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.

Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.

Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.

Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.