ByteOS Network

Source-psirt@adobe.com

Published At-13 Jan, 2010 | 19:30

Updated At-23 Apr, 2026 | 00:35

Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

Adobe Inc.

>>acrobat>>Versions up to 9.2(inclusive)

cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>3.0

cpe:2.3:a:adobe:acrobat:3.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>3.1

cpe:2.3:a:adobe:acrobat:3.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>4.0

cpe:2.3:a:adobe:acrobat:4.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>4.0.5

cpe:2.3:a:adobe:acrobat:4.0.5:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>4.0.5a

cpe:2.3:a:adobe:acrobat:4.0.5a:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>4.0.5c

cpe:2.3:a:adobe:acrobat:4.0.5c:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>5.0

cpe:2.3:a:adobe:acrobat:5.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>5.0.5

cpe:2.3:a:adobe:acrobat:5.0.5:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>5.0.6

cpe:2.3:a:adobe:acrobat:5.0.6:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>5.0.10

cpe:2.3:a:adobe:acrobat:5.0.10:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0

cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0.1

cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0.2

cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0.3

cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0.4

cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0.5

cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>6.0.6

cpe:2.3:a:adobe:acrobat:6.0.6:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0

cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.1

cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.2

cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.3

cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.4

cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.5

cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.6

cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.7

cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.8

cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.0.9

cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.1.0

cpe:2.3:a:adobe:acrobat:7.1.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.1.1

cpe:2.3:a:adobe:acrobat:7.1.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.1.2

cpe:2.3:a:adobe:acrobat:7.1.2:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.1.3

cpe:2.3:a:adobe:acrobat:7.1.3:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>7.1.4

cpe:2.3:a:adobe:acrobat:7.1.4:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.0

cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1

cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.1

cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.2

cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.3

cpe:2.3:a:adobe:acrobat:8.1.3:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.4

cpe:2.3:a:adobe:acrobat:8.1.4:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.5

cpe:2.3:a:adobe:acrobat:8.1.5:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.6

cpe:2.3:a:adobe:acrobat:8.1.6:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>8.1.7

cpe:2.3:a:adobe:acrobat:8.1.7:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>9.0

cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>9.1

cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>9.1.1

cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>9.1.2

cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat>>9.1.3

cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*

Apple Inc.

>>mac_os_x>>*

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Microsoft Corporation

>>windows>>*

cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*

Adobe Inc.

>>acrobat_reader>>Versions up to 9.2(inclusive)

cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-399	Primary	nvd@nist.gov

CWE ID: CWE-399

Type: Primary

Source: nvd@nist.gov

Evaluator Description

Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html a memory corruption vulnerability that could lead to code execution (CVE-2009-3955).

Evaluator Impact

Per: http://www.adobe.com/support/security/bulletins/apsb10-02.html Affected software versions Adobe Reader 9.2 and earlier versions for Windows, Macintosh, and UNIX Adobe Acrobat 9.2 and earlier versions for Windows and Macintosh

References

Hyperlink	Source	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=836	psirt@adobe.com	N/A
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	psirt@adobe.com	N/A
http://secunia.com/advisories/38138	psirt@adobe.com	N/A
http://secunia.com/advisories/38215	psirt@adobe.com	N/A
http://www.adobe.com/support/security/bulletins/apsb10-02.html	psirt@adobe.com	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html	psirt@adobe.com	N/A
http://www.securityfocus.com/bid/37757	psirt@adobe.com	N/A
http://www.securitytracker.com/id?1023446	psirt@adobe.com	N/A
http://www.us-cert.gov/cas/techalerts/TA10-013A.html	psirt@adobe.com	US Government Resource
http://www.vupen.com/english/advisories/2010/0103	psirt@adobe.com	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293	psirt@adobe.com	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/55553	psirt@adobe.com	N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8255	psirt@adobe.com	N/A
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=836	af854a3a-2127-422b-91ae-364da2661108	N/A
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/38138	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/38215	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.adobe.com/support/security/bulletins/apsb10-02.html	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0060.html	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/37757	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id?1023446	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.us-cert.gov/cas/techalerts/TA10-013A.html	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
http://www.vupen.com/english/advisories/2010/0103	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=554293	af854a3a-2127-422b-91ae-364da2661108	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/55553	af854a3a-2127-422b-91ae-364da2661108	N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8255	af854a3a-2127-422b-91ae-364da2661108	N/A