CVE-2009-1862: adobe acrobat +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2009-1862

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 21,2%

Kerentanan Out-of-bounds Write pada adobe acrobat, adobe acrobat reader +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 8 Juni 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.

Rincian

Terbit di NVD: 23 Juli 2009
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 21,2% peluang dieksploitasi; lebih tinggi dari 97,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability
Masuk KEV: 8 Juni 2022
Tenggat CISA: 22 Juni 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
adobe	acrobat	Versi 9.0 hingga 9.1.2
adobe	acrobat reader	Versi 9.0 hingga 9.1.2
adobe	flash player	Versi 9.0 hingga 9.0.159.0
adobe	flash player	Versi 10.0 hingga 10.0.22.87

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html broken link · advisory vendor
http://www.adobe.com/support/security/advisories/apsa09-03.html advisory vendor
http://www.kb.cert.org/vuls/id/259425 advisory pihak ketiga · pemerintah AS
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2009-1862 pemerintah AS
http://lists.apple.com/archives/security-announce/2009/Sep/msg00003.html mailing list · advisory pihak ketiga
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html mailing list · advisory pihak ketiga
http://security.gentoo.org/glsa/glsa-200908-04.xml advisory pihak ketiga
http://support.apple.com/kb/HT3864 advisory pihak ketiga
http://support.apple.com/kb/HT3865 advisory pihak ketiga
http://www.securityfocus.com/bid/35759 broken link · advisory pihak ketiga · vdb entry
http://bugs.adobe.com/jira/browse/FP-1265 broken link
http://isc.sans.org/diary.html?storyid=6847 not applicable
http://news.cnet.com/8301-27080_3-10293389-245.html broken link
http://secunia.com/advisories/36193 broken link
http://secunia.com/advisories/36374 broken link
http://secunia.com/advisories/36701 broken link
http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1 broken link
http://www.adobe.com/support/security/bulletins/apsb09-10.html not applicable
http://www.adobe.com/support/security/bulletins/apsb09-13.html not applicable
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-072209-2512-99 broken link
http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.