CVE-2009-3956

Description

The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8327

https://exchange.xforce.ibmcloud.com/vulnerabilities/55554

https://bugzilla.redhat.com/show_bug.cgi?id=554296

http://www.vupen.com/english/advisories/2010/0103

http://www.us-cert.gov/cas/techalerts/TA10-013A.html

http://www.stratsec.net/files/SS-2010-001_Stratsec_Acrobat_Script_Injection_Security_Advisory_v1.0.pdf

http://www.securitytracker.com/id?1023446

http://www.securityfocus.com/bid/37763

http://www.redhat.com/support/errata/RHSA-2010-0060.html

http://www.packetstormsecurity.org/1001-exploits/SS-2010-001.txt

http://www.adobe.com/support/security/bulletins/apsb10-02.html

http://secunia.com/advisories/38215

http://secunia.com/advisories/38138

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3