CVE-2009-3794

Adobe AIR < 1.5.3 and Flash Player < 10.0.42.34 - Remote Code Execution via Crafted JPEG Dimensions in SWF

Title source: llm
STIX 2.1

Description

Heap-based buffer overflow in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via crafted dimensions of JPEG data in an SWF file.

References (24)

Core 24
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-1657.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/54631
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4004
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021716.1-1
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/3456
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=543857
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8686
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15948
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7465
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1023307
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1023306
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37902
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/38241
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/0173
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/60885
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37584
Patch, Vendor Advisory x_refsource_confirm
http://www.adobe.com/support/security/bulletins/apsb09-19.html
Patch vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-1658.html
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/508336/100/0/threaded
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-343A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/37199

Scores

EPSS 0.1156
EPSS Percentile 95.5%

Details

CWE
CWE-119
Status published
Products (43)
adobe/adobe_air 1.0
adobe/adobe_air 1.0.1
adobe/adobe_air 1.1
adobe/adobe_air 1.5.1
adobe/adobe_air < 1.5.2
adobe/flash_player 7.0
adobe/flash_player 7.0.1
adobe/flash_player 7.0.25
adobe/flash_player 7.0.63
adobe/flash_player 7.0.69.0
... and 33 more
Published Dec 10, 2009
Tracked Since Feb 18, 2026