[Forgot Password]
Login  Register Subscribe

23631

 
 

127000

 
 

102010

 
 

909

 
 

81341

 
 

133

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2009-1492Date: (C)2009-04-30   (M)2018-02-19


The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score  : CVSS Score  : 9.3
Exploit Score: Exploit Score: 8.6
Impact Score : Impact Score : 10.0
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: MEDIUM
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: COMPLETE
Scope: Integrity: COMPLETE
Confidentiality: Availability: COMPLETE
Integrity:  
Availability:  
  





Reference:
SECTRACK-1022139
SUNALERT-259028
BID-34736
SECUNIA-34924
SECUNIA-35055
SECUNIA-35096
SECUNIA-35152
SECUNIA-35358
SECUNIA-35416
SECUNIA-35734
OSVDB-54130
EXPLOIT-DB-8569
ADV-2009-1189
ADV-2009-1317
GLSA-200907-06
RHSA-2009:0478
SUSE-SA:2009:027
SUSE-SR:2009:011
TA09-133B
VU#970180
http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txt
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953
http://www.adobe.com/support/security/bulletins/apsb09-06.html
reader-getannots-code-execution(50145)

CPE    30
cpe:/a:adobe:acrobat:4.0.5c
cpe:/a:adobe:acrobat:4.0.5a
cpe:/a:adobe:acrobat:4.0
cpe:/a:adobe:acrobat:7.1.0
...
CWE    1
CWE-399
OVAL    6
oval:org.secpod.oval:def:33396
oval:org.secpod.oval:def:33405
oval:org.secpod.oval:def:400087
oval:org.secpod.oval:def:18634
...

© 2013 SecPod Technologies