Unscored severity · published Feb 26, 2009
CVE-2009-0520
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows…
–
CVSS
28.5%
EPSS
No
On KEV
Description
Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."
Exploitation
Is it being used?
Exploit prediction (EPSS)28.5% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Air · Adobe
1.5 · source: NVD
FP
Flash Player · Adobe
through 10.0.12.36; 7.0; 7.0.1; 7.0.25; 7.0.63; 7.0.63; +29 more · source: NVD
FP
Flash Player For Linux · Adobe
through 10.0.15.3 · source: NVD
FL
Flex · Adobe
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0520
Patch
http://isc.sans.org/diary.html?storyid=5929
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773
lists.apple.com
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2009-0332.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2009-0334.html
secunia.com
http://secunia.com/advisories/34012
More from Air
8.8
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
8.8
CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability
8.8
CVE-2014-8439
Adobe Flash Player Dereferenced Pointer Vulnerability
8.8
CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity
8.8
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability