CVE-2009-3953

Published: Jan 13, 2010Modified: Apr 21, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

Affected (8)

Products: Adobe: Acrobat · Opensuse: Opensuse · Suse: Linux Enterprise, Linux Enterprise Debuginfo

1 product

1 product

2 products

Linux Enterprise

Linux Enterprise Debuginfo

Configuration A

3 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Adobe Acrobat	From 7.0 to 7.1.4
Adobe Acrobat	From 8.0 to 8.2
Adobe Acrobat	From 9.0 to 9.3

Running on/with	Platform Versions
Apple Mac Os X	All versions
Microsoft Windows	All versions

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Suse Linux Enterprise	Version 10.0 sp2
Suse Linux Enterprise	Version 10.0 sp3
Suse Linux Enterprise Debuginfo	Version 11

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (29)

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

Source: psirt@adobe.com

Mailing ListThird Party Advisory

http://osvdb.org/61690

Source: psirt@adobe.com

Broken Link

http://secunia.com/advisories/38138

Source: psirt@adobe.com

Broken Link

http://secunia.com/advisories/38215

Source: psirt@adobe.com

Broken Link

http://www.adobe.com/support/security/bulletins/apsb10-02.html

Source: psirt@adobe.com

Not ApplicablePatchVendor Advisory

http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl

Source: psirt@adobe.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0060.html

Source: psirt@adobe.com

Broken Link

http://www.securityfocus.com/bid/37758

Source: psirt@adobe.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1023446

Source: psirt@adobe.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA10-013A.html

Source: psirt@adobe.com

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2010/0103

Source: psirt@adobe.com

Broken LinkVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=554293

Source: psirt@adobe.com

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/55551

Source: psirt@adobe.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242

Source: psirt@adobe.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://osvdb.org/61690

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://secunia.com/advisories/38138

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://secunia.com/advisories/38215

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.adobe.com/support/security/bulletins/apsb10-02.html

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicablePatchVendor Advisory

http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0060.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/bid/37758

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1023446

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.us-cert.gov/cas/techalerts/TA10-013A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2010/0103

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=554293

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/55551

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.