PT-2009-1122 · Adobe · Reader+1

Vincent Danen · Published 2009-12-14 · Updated 2026-02-23 · CVE-2009-4324

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Reader versions 8.x through 8.2 Adobe Reader versions 9.x through 9.3 Adobe Acrobat versions 8.x through 8.2 Adobe Acrobat versions 9.x through 9.3

Description The issue is related to a use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api, which can be exploited by remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams. This vulnerability has been exploited in the wild. The vulnerability is associated with resource management errors in Adobe Reader and Adobe Acrobat.

Recommendations For Adobe Reader versions 8.x through 8.2, update to version 8.2 or later. For Adobe Reader versions 9.x through 9.3, update to version 9.3 or later. For Adobe Acrobat versions 8.x through 8.2, update to version 8.2 or later. For Adobe Acrobat versions 9.x through 9.3, update to version 9.3 or later. As a temporary workaround, consider avoiding the use of the Doc.media.newPlayer method in Multimedia.api until a patch is available. Restrict access to crafted PDF files using ZLib compressed streams to minimize the risk of exploitation.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

CWE-399

Related Identifiers

BDU:2022-03587

CVE-2009-4324

RHSA-2010:0037

RHSA-2010:0038

RHSA-2010:0060

Affected Products

Acrobat

Reader

References · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_media_newplayer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_media_newplayer.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16503 · Exploit
• 🔥 https://exploit-db.com/exploits/16623 · Exploit
• 🔥 http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html · Exploit
• 🔥 https://exploit-db.com/exploits/10618 · Exploit
• http://redhat.com/support/errata/RHSA-2010-0060.html · Vendor Advisory
• http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03587 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html · Vendor Advisory
• http://secunia.com/advisories/37690 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3518 · Vendor Advisory
• http://adobe.com/support/security/advisories/apsa09-07.html · Vendor Advisory
• http://secunia.com/advisories/38138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4324 · Security Note