CVSS: 9.3EPSS: 55%CPEs: 4EXPL: 0CVE-2009-1862 – Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
https://notcve.org/view.php?id=CVE-2009-1862
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009. Vulnerabilidad sin especificar en Adobe Reader , Acrobat de la v9.x a la v9.1.2 y Adobe Flash Player v9.x a la v9.0.159.0 y v10.x a la v10.0.22.87, permite a atacantes remotos ejecutar código de su elección a través de (1)una aplicación flash manipulada en un archivo .pdf o (2) un archivo .swf. Relacionado con el authplay.dll, como se ha explotado públicamente en julio del 2009. Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS). • http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html http://bugs.adobe.com/jira/browse/FP-1265 http://isc.sans.org/diary.html?storyid=6847 http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://news.cnet.com/8301-27080_3-10293389-245.html http://secunia.com/advisories/36193 http://secunia.com/advisories/36374 http://secunia.com/advisories/36701 http:/& • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 5CVE-2009-2564 – Adobe 9.x Related Service - 'getPlus_HelperSvc.exe' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2009-2564
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot. GetPlus Download Manager de NOS Microsystems, tal y como es usado en Reader de Adobe versión 1.6.2.36 y posiblemente otras versiones, Corel getPlus Download Manager anterior a versión 1.5.0.48, y posiblemente otros productos, instala el archivo NOS\bin\getPlus_HelperSvc.exe con permisos no confiables (Everyone:Full Control), que permite a los usuarios locales alcanzar privilegios SYSTEM mediante el reemplazo de getPlus_HelperSvc.exe por un programa de tipo caballo de troya, como es demostrado por el uso de getPlus Download Manager en Reader de Adobe. NOTA: en Reader de Adobe, el alcance de este problema es limitado debido a que el programa se elimina y el servicio asociado no se inicia automáticamente después de una instalación y reinicio con éxito. • https://www.exploit-db.com/exploits/9199 https://www.exploit-db.com/exploits/9223 http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html http://retrogod.altervista.org/9sg_adobe_local.html http://secunia.com/advisories/35930 http://secunia.com/advisories/36331 http://securitytracker.com/id?1023007 http://www.adobe.com/support/security/bulletins/apsb09-15.html http://www.exploit-db.com/exploits/9199 http://www.securityfocus.com/archive/1/505095/100/0/thr • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 1%CPEs: 83EXPL: 0CVE-2009-1857 – acroread: multiple security fixes in version 8.1.6 (APSB09-07)
https://notcve.org/view.php?id=CVE-2009-1857
Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allow attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a PDF document with a crafted TrueType font. Reader versión 7 y Acrobat versiones 7 anteriores a 7.1.3 de Adobe, Reader versión 8 y Acrobat versiones 8 anteriores a 8.1.6 y Reader versión 9 y Acrobat versiones 9 anteriores a 9.1.2 de Adobe, permite a los atacantes causar una denegación de servicio (corrupción de memoria) o posiblemente ejecutar código arbitrario por medio de un documento PDF con una fuente TrueType diseñada. • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/34580 http://secunia.com/advisories/35496 http://secunia.com/advisories/35655 http://secunia.com/advisories/35685 http://secunia.com/advisories/35734 http://security.gentoo.org/glsa/glsa-200907-06.xml http://securitytracker.com/id?1022361 http://www.adobe.com/support/security/bulletins/apsb09-07.html http:&# • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 32%CPEs: 83EXPL: 0CVE-2009-1859 – acroread: multiple security fixes in version 8.1.6 (APSB09-07)
https://notcve.org/view.php?id=CVE-2009-1859
Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption. Adobe Reader v7 y Acrobat v7 anteriores a v7.1.3, Adobe Reader v8 y Acrobat v8 anteriores a v8.1.6, y Adobe Reader v9 y Acrobat v9 anteriores a v9.1.2 podría permitir a atacantes ejecutar código arbitrario a través de vectores inespecíficos que inician la corrupción de la memoria. • http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/34580 http://secunia.com/advisories/35496 http://secunia.com/advisories/35655 http://secunia.com/advisories/35685 http://secunia.com/advisories/35734 http://security.gentoo.org/glsa/glsa-200907-06.xml http://securitytracker.com/id?1022361 http://www.adobe.com/support/security/bulletins/apsb09-07.html http:&# • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 50%CPEs: 83EXPL: 0CVE-2009-1856 – acroread: multiple security fixes in version 8.1.6 (APSB09-07)
https://notcve.org/view.php?id=CVE-2009-1856
Integer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows attackers to cause a denial of service or possibly execute arbitrary code via a PDF file containing unspecified parameters to the FlateDecode filter, which triggers a heap-based buffer overflow. Un desbordamiento entero en Reader versión 7 y Acrobat versiones 7 anteriores a 7.1.3 de Adobe, Reader versión 8 y Acrobat versiones 8 anteriores a 8.1.6 de Adobe, y Reader versión 9 y Acrobat versiones 9 anteriores a 9.1.2 de Adobe, permite a los atacantes causar una denegación de servicio o posiblemente ejecutar código arbitrario por medio de un archivo PDF que contiene parámetros en el filtro FlateDecode, lo que desencadena un desbordamiento de búfer en la región heap de la memoria. • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=807 http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/34580 http://secunia.com/advisories/35496 http://secunia.com/advisories/35655 http://secunia.com/advisories/35685 http://secunia.com/advisories/35734 http://security.gentoo.org/glsa/glsa-200907-06.xml http://securitytracker.com/id?1022361 ht • CWE-189: Numeric Errors •