CVE-2009-3951

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-10 · updated 2026-06-16
Weakness: CWE-200

Description

Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 on Windows allows remote attackers to obtain the names of local files via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4820.

Affected products

Adobe Air: through 1.5.2; 1.0, 1.0.1, 1.1, 1.5.1
Adobe Flash Player 24.0.0.186 and earlier.: through 10.0.32.18; 7.0, 7.0.1, 7.0.25, 7.0.63, 7.0.69.0, 7.0.70.0 (+32)

References

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html
http://osvdb.org/60891
http://secunia.com/advisories/37584
http://secunia.com/advisories/37902
http://secunia.com/advisories/38241
http://securitytracker.com/id?1023307
http://support.apple.com/kb/HT4004
http://www.adobe.com/support/security/bulletins/apsb09-19.html
http://www.securityfocus.com/bid/37199
http://www.us-cert.gov/cas/techalerts/TA09-343A.html
http://www.vupen.com/english/advisories/2009/3456

Get alerted when CVE-2009-3951 or the next vulnerability affects your stack