CVE-2009-1493

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 21.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-04-30 · updated 2026-06-16
Weakness: CWE-399

Description

The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument.

Affected products

Adobe Reader: 8.1.4, 9.1

References

http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.html
http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://osvdb.org/54129
http://packetstorm.linuxsecurity.com/0904-exploits/spell.txt
http://secunia.com/advisories/34924
http://secunia.com/advisories/35055
http://secunia.com/advisories/35096
http://secunia.com/advisories/35152
http://secunia.com/advisories/35358
http://secunia.com/advisories/35416

Get alerted when CVE-2009-1493 or the next vulnerability affects your stack