CVE-2009-0520

CVSS V2 High 9.3 CVSS V3 None
Description
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
Overview
  • CVE ID
  • CVE-2009-0520
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-02-26T16:17:19
  • Last Modified Date
  • 2017-09-29T01:33:51
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:adobe:air:1.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* 1 OR 10.0.12.36
cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.0.63:*:linux:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0:*:basic:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0:*:pro:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:cs3:*:pro:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player:cs4:*:pro:*:*:*:*:* 1 OR
cpe:2.3:a:adobe:flash_player_for_linux:*:*:*:*:*:*:*:* 1 OR 10.0.15.3
cpe:2.3:a:adobe:flex:3.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773
http://rhn.redhat.com/errata/RHSA-2009-0334.html
http://isc.sans.org/diary.html?storyid=5929 Patch
http://www.vupen.com/english/advisories/2009/0513 Patch
https://bugzilla.redhat.com/show_bug.cgi?id=487142
http://rhn.redhat.com/errata/RHSA-2009-0332.html
http://www.adobe.com/support/security/bulletins/apsb09-01.html Patch Vendor Advisory
http://www.securityfocus.com/bid/33880 Patch
http://secunia.com/advisories/34012
http://securitytracker.com/id?1021750
http://secunia.com/advisories/34226
http://security.gentoo.org/glsa/glsa-200903-23.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-66-254909-1
http://www.vupen.com/english/advisories/2009/0743
http://secunia.com/advisories/34293
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://www.vupen.com/english/advisories/2009/1297
http://support.apple.com/kb/HT3549
http://secunia.com/advisories/35074
http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/48887
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6593
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16057
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-0520
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0520
History
Created Old Value New Value Data Type Notes
2022-05-10 08:19:41 Added to TrackCVE