CVE-2009-3956

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-01-13 · updated 2026-06-16
Weakness: CWE-16

Description

The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.

Affected products

Adobe Acrobat for Edge: through 9.2; 3.0, 3.1, 4.0, 4.0.5, 4.0.5a, 4.0.5c (+40)
Adobe Acrobat Reader: through 9.2; 3.0, 3.01, 3.02, 4.0, 4.0.5, 4.0.5a (+43)

References

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://secunia.com/advisories/38138
http://secunia.com/advisories/38215
http://www.adobe.com/support/security/bulletins/apsb10-02.html
http://www.packetstormsecurity.org/1001-exploits/SS-2010-001.txt
http://www.redhat.com/support/errata/RHSA-2010-0060.html
http://www.securityfocus.com/bid/37763
http://www.securitytracker.com/id?1023446
http://www.stratsec.net/files/SS-2010-001_Stratsec_Acrobat_Script_Injection_Security_Advisory_v1.0.pdf
http://www.us-cert.gov/cas/techalerts/TA10-013A.html
http://www.vupen.com/english/advisories/2010/0103
https://bugzilla.redhat.com/show_bug.cgi?id=554296

Get alerted when CVE-2009-3956 or the next vulnerability affects your stack