ByteOS Network

NVD Vulnerability Details :

CVE-2009-3953

Analyzed

Source-psirt@adobe.com

View Known Exploited Vulnerability (KEV) details

Published At-13 Jan, 2010 | 19:30

Updated At-21 Apr, 2026 | 21:12

The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-06-08	2022-06-22	Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability	Apply updates per vendor instructions.

Date Added: 2022-06-08

Due Date: 2022-06-22

Vulnerability Name: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

Adobe Inc.

>>acrobat>>Versions from 7.0(inclusive) to 7.1.4(exclusive)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>Versions from 8.0(inclusive) to 8.2(exclusive)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>Versions from 9.0(inclusive) to 9.3(exclusive)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Apple Inc.

>>mac_os_x>>-

cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows>>-

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

SUSE

>>linux_enterprise_debuginfo>>11

cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*

openSUSE

>>opensuse>>11.1

cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*

openSUSE

>>opensuse>>11.2

cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*

SUSE

>>linux_enterprise>>10.0

cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*

SUSE

>>linux_enterprise>>10.0

cpe:2.3:o:suse:linux_enterprise:10.0:sp3:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov
CWE-787	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-787

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-787

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Evaluator Impact

Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html Affected software versions: Adobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX Adobe Acrobat 9.2 and earlier versions for Windows and Macintosh

References

Hyperlink	Source	Resource
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	psirt@adobe.com	Mailing List Third Party Advisory
http://osvdb.org/61690	psirt@adobe.com	Broken Link
http://secunia.com/advisories/38138	psirt@adobe.com	Broken Link
http://secunia.com/advisories/38215	psirt@adobe.com	Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-02.html	psirt@adobe.com	Not Applicable Patch Vendor Advisory
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl	psirt@adobe.com	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html	psirt@adobe.com	Broken Link
http://www.securityfocus.com/bid/37758	psirt@adobe.com	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1023446	psirt@adobe.com	Broken Link Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA10-013A.html	psirt@adobe.com	Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2010/0103	psirt@adobe.com	Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293	psirt@adobe.com	Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/55551	psirt@adobe.com	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242	psirt@adobe.com	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
http://osvdb.org/61690	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/38138	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/38215	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.adobe.com/support/security/bulletins/apsb10-02.html	af854a3a-2127-422b-91ae-364da2661108	Not Applicable Patch Vendor Advisory
http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.securityfocus.com/bid/37758	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1023446	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA10-013A.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2010/0103	af854a3a-2127-422b-91ae-364da2661108	Broken Link Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293	af854a3a-2127-422b-91ae-364da2661108	Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/55551	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-3953	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

Source: psirt@adobe.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: http://osvdb.org/61690

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/38138

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://secunia.com/advisories/38215

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://www.adobe.com/support/security/bulletins/apsb10-02.html

Source: psirt@adobe.com

Resource:

Not Applicable

Patch

Vendor Advisory

Hyperlink: http://www.metasploit.com/modules/exploit/windows/fileformat/adobe_u3d_meshdecl

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: http://www.redhat.com/support/errata/RHSA-2010-0060.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://www.securityfocus.com/bid/37758

Source: psirt@adobe.com

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id?1023446

Source: psirt@adobe.com

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA10-013A.html

Source: psirt@adobe.com

Resource:

Third Party Advisory

US Government Resource

Hyperlink: http://www.vupen.com/english/advisories/2010/0103

Source: psirt@adobe.com

Resource:

Broken Link

Vendor Advisory

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=554293

Source: psirt@adobe.com

Resource:

Issue Tracking

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/55551

Source: psirt@adobe.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8242

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html