Vulnerability Name:

CVE-2009-0509 (CCN-49239)

Assigned:2009-06-09
Published:2009-06-09
Updated:2017-08-08
Summary:Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to execute arbitrary code via a crafted file that triggers memory corruption.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-0509

Source: SUSE
Type: UNKNOWN
SUSE-SA:2009:035

Source: SUSE
Type: UNKNOWN
SUSE-SR:2009:012

Source: CCN
Type: RHSA-2009-1109
Critical: acroread security update

Source: CCN
Type: SA34580
Adobe Reader/Acrobat Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
34580

Source: SECUNIA
Type: UNKNOWN
35496

Source: SECUNIA
Type: UNKNOWN
35655

Source: SECUNIA
Type: UNKNOWN
35685

Source: SECUNIA
Type: UNKNOWN
35734

Source: GENTOO
Type: UNKNOWN
GLSA-200907-06

Source: CCN
Type: SECTRACK ID: 1022361
Adobe Acrobat and Adobe Reader Buffer Overflows Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1022361

Source: CCN
Type: ASA-2009-241
acroread security update (RHSA-2009-1109)

Source: CCN
Type: NORTEL BULLETIN ID: 2009009587, Rev 1
Nortel Response to APSB09-07 Adobe Quarterly Security Update for June 2009

Source: CCN
Type: Adobe Security Bulletin APSB09-07
Security Updates available for Adobe Reader and Acrobat

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb09-07.html

Source: CCN
Type: GLSA-200907-06
Adobe Reader: User-assisted execution of arbitrary code

Source: CCN
Type: IBM Internet Security Systems Protection Advisory
Multiple JBIG2 Vulnerabilities in Adobe Acrobat and Adobe Reader

Source: CCN
Type: OSVDB ID: 56107
Adobe Reader / Acrobat JBIG2 Filter Crafted File Handling Unspecified Overflow

Source: REDHAT
Type: UNKNOWN
RHSA-2009:1109

Source: BID
Type: UNKNOWN
35274

Source: CCN
Type: BID-35274
Adobe Reader and Acrobat 9.1.1 and Prior Multiple Remote Vulnerabilities

Source: CCN
Type: BID-35303
Adobe Reader and Acrobat JBIG Segments 'Text Region' Memory Corruption Vulnerability

Source: CERT
Type: US Government Resource
TA09-161A

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-1547

Source: XF
Type: UNKNOWN
reader-textregion-bo(49239)

Source: XF
Type: UNKNOWN
reader-text-bo(49239)

Source: SUSE
Type: SUSE-SA:2009:035
Acrobat Reader security problems

Source: SUSE
Type: SUSE-SR:2009:012
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2009:014
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:adobe:acrobat:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.1:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.1:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.2:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.2:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.3:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.3:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.4:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.4:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.5:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.5:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.6:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.6:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.7:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.7:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:elements:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.8:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.0.9:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:7.1.1:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.0:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.0:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.1:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.1:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.2:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.2:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.2:security_update:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.3:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.3:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.4:*:professional:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:8.1.4:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.0:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.1:*:standard:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.2:security_update:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:8.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*

  • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_extras:3:*:*:*:*:*:*:*

  • Configuration RedHat 2:
  • cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*

  • Configuration RedHat 3:
  • cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:9:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*
  • OR cpe:/a:adobe:acrobat:9.1:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_extras:3:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_extras:4:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
  • OR cpe:/o:opensuse:opensuse:11.0:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20090509
    V
    CVE-2009-0509
    2015-11-16
    oval:org.mitre.oval:def:22229
    P
    ELSA-2009:1109: acroread security update (Critical)
    2014-05-26
    oval:com.redhat.rhsa:def:20091109
    P
    RHSA-2009:1109: acroread security update (Critical)
    2009-06-17
    BACK
    adobe acrobat 7.0
    adobe acrobat 7.0
    adobe acrobat 7.0
    adobe acrobat 7.0.1
    adobe acrobat 7.0.1
    adobe acrobat 7.0.1
    adobe acrobat 7.0.2
    adobe acrobat 7.0.2
    adobe acrobat 7.0.2
    adobe acrobat 7.0.3
    adobe acrobat 7.0.3
    adobe acrobat 7.0.3
    adobe acrobat 7.0.4
    adobe acrobat 7.0.4
    adobe acrobat 7.0.4
    adobe acrobat 7.0.5
    adobe acrobat 7.0.5
    adobe acrobat 7.0.5
    adobe acrobat 7.0.6
    adobe acrobat 7.0.6
    adobe acrobat 7.0.6
    adobe acrobat 7.0.7
    adobe acrobat 7.0.7
    adobe acrobat 7.0.7
    adobe acrobat 7.0.8
    adobe acrobat 7.0.8
    adobe acrobat 7.0.8
    adobe acrobat 7.0.8
    adobe acrobat 7.0.9
    adobe acrobat 7.0.9
    adobe acrobat 7.1
    adobe acrobat 7.1
    adobe acrobat 7.1
    adobe acrobat 7.1.0
    adobe acrobat 7.1.1
    adobe acrobat 7.1.1
    adobe acrobat 8.0
    adobe acrobat 8.0
    adobe acrobat 8.0
    adobe acrobat 8.1
    adobe acrobat 8.1
    adobe acrobat 8.1.1
    adobe acrobat 8.1.1
    adobe acrobat 8.1.1
    adobe acrobat 8.1.2
    adobe acrobat 8.1.2
    adobe acrobat 8.1.2
    adobe acrobat 8.1.2 security_update
    adobe acrobat 8.1.3
    adobe acrobat 8.1.3
    adobe acrobat 8.1.3
    adobe acrobat 8.1.4
    adobe acrobat 8.1.4
    adobe acrobat 8.1.4
    adobe acrobat 9
    adobe acrobat 9.0
    adobe acrobat 9.0
    adobe acrobat 9.0.0
    adobe acrobat 9.1
    adobe acrobat 9.1
    adobe acrobat reader 7.0
    adobe acrobat reader 7.0.1
    adobe acrobat reader 7.0.2
    adobe acrobat reader 7.0.3
    adobe acrobat reader 7.0.4
    adobe acrobat reader 7.0.5
    adobe acrobat reader 7.0.6
    adobe acrobat reader 7.0.7
    adobe acrobat reader 7.0.8
    adobe acrobat reader 7.0.9
    adobe acrobat reader 7.1
    adobe acrobat reader 7.1.1
    adobe acrobat reader 8.0
    adobe acrobat reader 8.1
    adobe acrobat reader 8.1.1
    adobe acrobat reader 8.1.2
    adobe acrobat reader 8.1.2 security_update
    adobe acrobat reader 8.1.3
    adobe acrobat reader 8.1.4
    adobe acrobat reader 8.1.5
    adobe acrobat reader 9
    adobe acrobat reader 9.1
    adobe acrobat reader 9.1.1
    adobe acrobat reader 9.0
    adobe acrobat reader 9
    adobe acrobat 9.0
    adobe acrobat reader 9.1
    adobe acrobat 9.1
    gentoo linux *
    redhat rhel extras 3
    redhat rhel extras 4
    novell opensuse 10.3
    novell opensuse 11.0