Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.

Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4324 to the following vulnerability:

Name: CVE-2009-4324 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324 Assigned: 20091214 Reference: MISC: http://blogs.adobe.com/psirt/2009/12/newadobereaderandacrobatv.html

Unspecified vulnerability in Adobe Reader and Acrobat 9.2 and earlier has unknown impact and attack vectors, as exploited in the wild in December 2009.

An unconfirmed third-party posting [1] indicates this vulnerability is in the JavaScript processing, so a proposed work-around is to disable JavaScript (Edit -> Preferences -> JavaScript). This has not been official confirmed by Adobe.

[1] http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted document, related to a "cross origin wrapper bypass."

Buffer overflow in the utilpathencode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.

A privilege escalation flaw was found in the way udev used to check for the origin of messages sent from the NETLINK service. An attacker could use this flaw to escalate his privileges by sending the NETLINK message from userspace process, instead of from the kernel.

Acknowledgements:

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for responsibly reporting this flaw.