CVE-2009-0193 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Adobe Acrobat Reader

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input Validation10 documents4 sources
Severity
9.3CRITICALNVD
EPSS
13.5%
top 5.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Adobe Acrobat ReaderAdobe AcrobatAdobe Reader
Timeline
PublishedMar 25
Latest updateMay 2

Description

Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a PDF file with a malformed JBIG2 symbol dictionary segment, a different vulnerability than CVE-2009-1061 and CVE-2009-1062.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDadobe/acrobat_reader7.0 — 7.1.1+4
▶NVDadobe/acrobat9.0+18
▶NVDadobe/reader32 versions+31

Patches

Patch: www.adobe.com ↗Patch: www.securityfocus.com ↗Patch: www.adobe.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-4hh3-c3j6-h827: Adobe Acrobat Reader 9 before 9↗2022-05-02
▶
GHSA
GHSA-468h-v4jh-mq8c: Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9↗2022-05-02
▶
GHSA
GHSA-8g25-qvgj-fp7w: Unspecified vulnerability in Adobe Acrobat Reader 9 before 9↗2022-05-02
▶

📋Vendor Advisories

3
Red Hat
acroread: multiple JBIG2-related security flaws↗2009-02-19
▶
Red Hat
acroread: multiple JBIG2-related security flaws↗2009-02-19
▶
Red Hat
acroread: multiple JBIG2-related security flaws↗2009-02-19
▶

💬Community

1
Bugzilla
CVE-2009-0658, CVE-2009-0193, CVE-2009-0928, CVE-2009-1061, CVE-2009-1062 acroread: multiple JBIG2-related security flaws↗2009-02-23
▶
CVE-2009-0193 — Adobe Acrobat Reader vulnerability | cvebase