Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-1868

CWE-119 — Buffer Overflow5 documents5 sources
Severity
9.3CRITICAL
EPSS
18.5%
top 4.75%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Adobe AIRAdobe Flash PlayerAdobe Flex
Timeline
PublishedJul 31
Latest updateMay 2

Description

Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors involving URL parsing.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDadobe/flash_player10.0.22.87+30
▶NVDadobe/air1.5.1+4
▶NVDadobe/flex3.0

Patches

Patch: www.adobe.com ↗Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4qww-9ghh-23c6: Heap-based buffer overflow in Adobe Flash Player before 9↗2022-05-02
▶
CVEList
CVE-2009-1868: Heap-based buffer overflow in Adobe Flash Player before 9↗2009-07-31
▶

💥Exploits & PoCs

1
Exploit-DB
Adobe Flash Player 10.0.22 / AIR - URI Parsing Heap Buffer Overflow (PoC)↗2009-07-30
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: multiple code execution flaws (APSB09-10)↗2009-07-30
▶
CVE-2009-1868 (CRITICAL CVSS 9.3) | Heap-based buffer overflow in Adobe | cvebase.io