CVE-2009-3794

Published: Dec 10, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via crafted dimensions of JPEG data in an SWF file.

Affected (46)

Products: Adobe: Adobe Air, Flash Player

2 products

Configuration A

46 vulnerable

Vulnerable Software	Affected Versions
Adobe Adobe Air	Up to 1.5.2
Adobe Adobe Air	Version 1.0.1
Adobe Adobe Air	Version 1.0
Adobe Adobe Air	Version 1.1
Adobe Adobe Air	Version 1.5.1
Adobe Flash Player	Up to 10.0.32.18
Adobe Flash Player	Version 10.0.0.584
Adobe Flash Player	Version 10.0.12.10
Adobe Flash Player	Version 10.0.12.36
Adobe Flash Player	Version 10.0.22.87
Adobe Flash Player	Version 7.0.1
Adobe Flash Player	Version 7.0.25
Adobe Flash Player	Version 7.0.63
Adobe Flash Player	Version 7.0.69.0
Adobe Flash Player	Version 7.0.70.0
Adobe Flash Player	Version 7.0
Adobe Flash Player	Version 7.1.1
Adobe Flash Player	Version 7.1
Adobe Flash Player	Version 7.2
Adobe Flash Player	Version 8.0.24.0
Adobe Flash Player	Version 8.0.34.0
Adobe Flash Player	Version 8.0.35.0
Adobe Flash Player	Version 8.0.39.0
Adobe Flash Player	Version 8.0
Adobe Flash Player	Version 8.0
Adobe Flash Player	Version 8.0
Adobe Flash Player	Version 8
Adobe Flash Player	Version 8
Adobe Flash Player	Version 9.0.112.0
Adobe Flash Player	Version 9.0.114.0
Adobe Flash Player	Version 9.0.115.0
Adobe Flash Player	Version 9.0.124.0
Adobe Flash Player	Version 9.0.155.0
Adobe Flash Player	Version 9.0.159.0
Adobe Flash Player	Version 9.0.16
Adobe Flash Player	Version 9.0.18d60
Adobe Flash Player	Version 9.0.20.0
Adobe Flash Player	Version 9.0.20
Adobe Flash Player	Version 9.0.28.0
Adobe Flash Player	Version 9.0.28
Adobe Flash Player	Version 9.0.31.0
Adobe Flash Player	Version 9.0.31
Adobe Flash Player	Version 9.0.45.0
Adobe Flash Player	Version 9.0.47.0
Adobe Flash Player	Version 9.0
Adobe Flash Player	Version 9.125.0

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (48)

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html

Source: psirt@adobe.com

http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html

Source: psirt@adobe.com

http://osvdb.org/60885

Source: psirt@adobe.com

http://secunia.com/advisories/37584

Source: psirt@adobe.com

Vendor Advisory

http://secunia.com/advisories/37902

Source: psirt@adobe.com

http://secunia.com/advisories/38241

Source: psirt@adobe.com

http://securitytracker.com/id?1023306

Source: psirt@adobe.com

http://securitytracker.com/id?1023307

Source: psirt@adobe.com

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021716.1-1

Source: psirt@adobe.com

http://support.apple.com/kb/HT4004

Source: psirt@adobe.com

http://www.adobe.com/support/security/bulletins/apsb09-19.html

Source: psirt@adobe.com

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-1657.html

Source: psirt@adobe.com

http://www.redhat.com/support/errata/RHSA-2009-1658.html

Source: psirt@adobe.com

Patch

http://www.securityfocus.com/archive/1/508336/100/0/threaded

Source: psirt@adobe.com

http://www.securityfocus.com/bid/37199

Source: psirt@adobe.com

http://www.us-cert.gov/cas/techalerts/TA09-343A.html

Source: psirt@adobe.com

US Government Resource

http://www.vupen.com/english/advisories/2009/3456

Source: psirt@adobe.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/0173

Source: psirt@adobe.com

http://zerodayinitiative.com/advisories/ZDI-09-092/

Source: psirt@adobe.com

Patch

https://bugzilla.redhat.com/show_bug.cgi?id=543857

Source: psirt@adobe.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/54631

Source: psirt@adobe.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15948

Source: psirt@adobe.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7465

Source: psirt@adobe.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8686

Source: psirt@adobe.com

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/60885

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37584

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/37902

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/38241

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1023306

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1023307

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021716.1-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT4004

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.adobe.com/support/security/bulletins/apsb09-19.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-1657.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-1658.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/archive/1/508336/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/37199

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-343A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2009/3456

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.vupen.com/english/advisories/2010/0173

Source: af854a3a-2127-422b-91ae-364da2661108

http://zerodayinitiative.com/advisories/ZDI-09-092/

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://bugzilla.redhat.com/show_bug.cgi?id=543857

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/54631

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15948

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7465

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8686

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.