[Forgot Password]
Login  Register Subscribe

24128

 
 

131615

 
 

112965

 
 

909

 
 

87888

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2009-1492Date: (C)2009-04-30   (M)2018-06-09


The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 9.3
Exploit Score: 8.6
Impact Score: 10.0
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: COMPLETE
Integrity: COMPLETE
Availability: COMPLETE
  
Reference:
SECTRACK-1022139
SUNALERT-259028
BID-34736
SECUNIA-34924
SECUNIA-35055
SECUNIA-35096
SECUNIA-35152
SECUNIA-35358
SECUNIA-35416
SECUNIA-35734
OSVDB-54130
EXPLOIT-DB-8569
ADV-2009-1189
ADV-2009-1317
GLSA-200907-06
RHSA-2009:0478
SUSE-SA:2009:027
SUSE-SR:2009:011
TA09-133B
VU#970180
http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953
http://www.adobe.com/support/security/bulletins/apsb09-06.html
reader-getannots-code-execution(50145)

CPE    30
cpe:/a:adobe:acrobat:4.0.5c
cpe:/a:adobe:acrobat:4.0.5a
cpe:/a:adobe:acrobat:4.0
cpe:/a:adobe:acrobat:7.1.0
...
CWE    1
CWE-399
OVAL    6
oval:org.secpod.oval:def:33396
oval:org.secpod.oval:def:33405
oval:org.secpod.oval:def:400087
oval:org.secpod.oval:def:18634
...

© SecPod Technologies