CVE-2009-4324

adobe acrobat, adobe acrobat reader, suse linux enterprise debuginfo

Published 15 Dec 2009 · updated 16 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 8 Jun 2022, with a remediation deadline of 22 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

References

blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html · Broken Link, Vendor Advisory
contagiodump.blogspot.com/2009/12/virustotal-httpwww.html · Exploit, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html · Mailing List, Third Party Advisory
osvdb.org/60980 · Broken Link
secunia.com/advisories/37690 · Broken Link, Vendor Advisory
secunia.com/advisories/38138 · Broken Link, Vendor Advisory
secunia.com/advisories/38215 · Broken Link, Vendor Advisory
www.adobe.com/support/security/advisories/apsa09-07.html · Vendor Advisory
www.adobe.com/support/security/bulletins/apsb10-02.html · Not Applicable
www.kb.cert.org/vuls/id/508357 · Third Party Advisory, US Government Resource
www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb · Broken Link
www.redhat.com/support/errata/RHSA-2010-0060.html · Broken Link
www.securityfocus.com/bid/37331 · Broken Link, Third Party Advisory, VDB Entry
www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214 · Broken Link
www.symantec.com/connect/blogs/zero-day-xmas-present · Broken Link
www.us-cert.gov/cas/techalerts/TA10-013A.html · Third Party Advisory, US Government Resource
www.vupen.com/english/advisories/2009/3518 · Broken Link, Vendor Advisory
www.vupen.com/english/advisories/2010/0103 · Broken Link
bugzilla.redhat.com/show_bug.cgi?id=547799 · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/54747 · Third Party Advisory, VDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6795 · Broken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-4324 · US Government Resource