7.8
HIGH
CVE-2009-0658
Adobe Reader/JBIG2 Buffer Overflow Vulnerability
Description

Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF document, related to a non-JavaScript function call and possibly an embedded JBIG2 image stream, as exploited in the wild in February 2009 by Trojan.Pidief.E.

INFO

Published Date :

Feb. 20, 2009, 7:30 p.m.

Last Modified :

Nov. 21, 2024, 1 a.m.

Source :

[email protected]

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.8
Public PoC/Exploit Available at Github

CVE-2009-0658 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2009-0658 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Adobe acrobat
2 Adobe acrobat_reader
: Total Affected Vendor : 1 | Products : 2
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2009-0658.

URL Resource
http://isc.sans.org/diary.html?n&storyid=5902 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html Third Party Advisory
http://osvdb.org/52073 Broken Link
http://secunia.com/advisories/33901 Third Party Advisory
http://secunia.com/advisories/34392 Third Party Advisory
http://secunia.com/advisories/34490 Third Party Advisory
http://secunia.com/advisories/34706 Third Party Advisory
http://secunia.com/advisories/34790 Third Party Advisory
http://security.gentoo.org/glsa/glsa-200904-17.xml Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1 Third Party Advisory
http://www.adobe.com/support/security/advisories/apsa09-01.html Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb09-04.html Vendor Advisory
http://www.kb.cert.org/vuls/id/905281 Third Party Advisory US Government Resource
http://www.redhat.com/support/errata/RHSA-2009-0376.html Third Party Advisory
http://www.securityfocus.com/bid/33751 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021739 Third Party Advisory VDB Entry
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 Third Party Advisory
http://www.symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=2 Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-051A.html Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2009/0472 Third Party Advisory
http://www.vupen.com/english/advisories/2009/1019 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48825 VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5697 Tool Signature
https://www.exploit-db.com/exploits/8090 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/8099 Third Party Advisory VDB Entry
http://isc.sans.org/diary.html?n&storyid=5902 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html Third Party Advisory
http://osvdb.org/52073 Broken Link
http://secunia.com/advisories/33901 Third Party Advisory
http://secunia.com/advisories/34392 Third Party Advisory
http://secunia.com/advisories/34490 Third Party Advisory
http://secunia.com/advisories/34706 Third Party Advisory
http://secunia.com/advisories/34790 Third Party Advisory
http://security.gentoo.org/glsa/glsa-200904-17.xml Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1 Third Party Advisory
http://www.adobe.com/support/security/advisories/apsa09-01.html Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb09-04.html Vendor Advisory
http://www.kb.cert.org/vuls/id/905281 Third Party Advisory US Government Resource
http://www.redhat.com/support/errata/RHSA-2009-0376.html Third Party Advisory
http://www.securityfocus.com/bid/33751 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1021739 Third Party Advisory VDB Entry
http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 Third Party Advisory
http://www.symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=2 Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-051A.html Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2009/0472 Third Party Advisory
http://www.vupen.com/english/advisories/2009/1019 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/48825 VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5697 Tool Signature
https://www.exploit-db.com/exploits/8090 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/8099 Third Party Advisory VDB Entry

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
0xCyberY/CVE-T4PDF

CVEs and Techniques used PDF as an attack vector.

Updated: 2 months, 2 weeks ago
54 stars 12 fork 12 watcher
Born at : June 22, 2022, 6:01 a.m. This repo has been linked 701 different CVEs too.
Profile Photo
Cryin/Paper

Web Security Technology & Vulnerability Analysis Whitepapers

web-security-research vulnerability-analysis security-technology-paper

Updated: 2 months, 2 weeks ago
535 stars 117 fork 117 watcher
Born at : Aug. 15, 2016, 5:29 a.m. This repo has been linked 8 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2009-0658 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2009-0658 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Modified Analysis by [email protected]

    Sep. 27, 2019

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    Changed Reference Type http://isc.sans.org/diary.html?n&storyid=5902 No Types Assigned http://isc.sans.org/diary.html?n&storyid=5902 Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html No Types Assigned http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html No Types Assigned http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html Third Party Advisory
    Changed Reference Type http://osvdb.org/52073 No Types Assigned http://osvdb.org/52073 Broken Link
    Changed Reference Type http://secunia.com/advisories/33901 No Types Assigned http://secunia.com/advisories/33901 Third Party Advisory
    Changed Reference Type http://secunia.com/advisories/34392 No Types Assigned http://secunia.com/advisories/34392 Third Party Advisory
    Changed Reference Type http://secunia.com/advisories/34490 No Types Assigned http://secunia.com/advisories/34490 Third Party Advisory
    Changed Reference Type http://secunia.com/advisories/34706 No Types Assigned http://secunia.com/advisories/34706 Third Party Advisory
    Changed Reference Type http://secunia.com/advisories/34790 No Types Assigned http://secunia.com/advisories/34790 Third Party Advisory
    Changed Reference Type http://security.gentoo.org/glsa/glsa-200904-17.xml No Types Assigned http://security.gentoo.org/glsa/glsa-200904-17.xml Third Party Advisory
    Changed Reference Type http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1 No Types Assigned http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1 Third Party Advisory
    Changed Reference Type http://www.adobe.com/support/security/bulletins/apsb09-04.html No Types Assigned http://www.adobe.com/support/security/bulletins/apsb09-04.html Vendor Advisory
    Changed Reference Type http://www.kb.cert.org/vuls/id/905281 US Government Resource http://www.kb.cert.org/vuls/id/905281 Third Party Advisory, US Government Resource
    Changed Reference Type http://www.redhat.com/support/errata/RHSA-2009-0376.html No Types Assigned http://www.redhat.com/support/errata/RHSA-2009-0376.html Third Party Advisory
    Changed Reference Type http://www.securityfocus.com/bid/33751 No Types Assigned http://www.securityfocus.com/bid/33751 Third Party Advisory, VDB Entry
    Changed Reference Type http://www.securitytracker.com/id?1021739 No Types Assigned http://www.securitytracker.com/id?1021739 Third Party Advisory, VDB Entry
    Changed Reference Type http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 No Types Assigned http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 Third Party Advisory
    Changed Reference Type http://www.symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=2 No Types Assigned http://www.symantec.com/security_response/writeup.jsp?docid=2009-021212-5523-99&tabid=2 Third Party Advisory
    Changed Reference Type http://www.us-cert.gov/cas/techalerts/TA09-051A.html US Government Resource http://www.us-cert.gov/cas/techalerts/TA09-051A.html Third Party Advisory, US Government Resource
    Changed Reference Type http://www.vupen.com/english/advisories/2009/0472 No Types Assigned http://www.vupen.com/english/advisories/2009/0472 Third Party Advisory
    Changed Reference Type http://www.vupen.com/english/advisories/2009/1019 No Types Assigned http://www.vupen.com/english/advisories/2009/1019 Third Party Advisory
    Changed Reference Type https://exchange.xforce.ibmcloud.com/vulnerabilities/48825 No Types Assigned https://exchange.xforce.ibmcloud.com/vulnerabilities/48825 VDB Entry
    Changed Reference Type https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5697 No Types Assigned https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5697 Tool Signature
    Changed Reference Type https://www.exploit-db.com/exploits/8090 No Types Assigned https://www.exploit-db.com/exploits/8090 Third Party Advisory, VDB Entry
    Changed Reference Type https://www.exploit-db.com/exploits/8099 No Types Assigned https://www.exploit-db.com/exploits/8099 Third Party Advisory, VDB Entry
    Changed CPE Configuration OR *cpe:2.3:a:adobe:acrobat:6.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:6.0.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:6.0.2:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:6.0.3:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:6.0.4:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:6.0.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.2:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.3:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.4:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.6:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.7:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.8:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:7.0.9:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:8.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:8.1.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:8.1.2:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat:9:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:3.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:4.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:4.0.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:4.0.5a:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:4.0.5c:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:4.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0.6:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0.7:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0.9:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0.10:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.0.11:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:5.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:7.0.9:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:8.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:8.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:8.1.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:8.1.2:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* versions up to (including) 9 *cpe:2.3:a:adobe:reader:8.1.1:*:*:*:*:*:*:* *cpe:2.3:a:adobe:reader:8.1.2:*:*:*:*:*:*:* OR *cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (including) 7.1.1 *cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* versions from (including) 8.0 up to (including) 8.1.4 *cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:* *cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (including) 7.1.1 *cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* versions from (including) 8.0 up to (including) 8.1.4 *cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*
  • CPE Deprecation Remap by [email protected]

    Oct. 30, 2018

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:a:adobe:acrobat:8.0.0:*:*:*:*:*:*:* OR *cpe:2.3:a:adobe:acrobat:8.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Sep. 29, 2017

    Action Type Old Value New Value
    Removed Reference http://www.milw0rm.com/exploits/8099 [No Types Assigned]
    Removed Reference http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:5697 [No Types Assigned]
    Removed Reference http://www.milw0rm.com/exploits/8090 [No Types Assigned]
    Added Reference https://www.exploit-db.com/exploits/8099 [No Types Assigned]
    Added Reference https://www.exploit-db.com/exploits/8090 [No Types Assigned]
    Added Reference https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5697 [No Types Assigned]
  • CVE Modified by [email protected]

    Aug. 17, 2017

    Action Type Old Value New Value
    Removed Reference http://xforce.iss.net/xforce/xfdb/48825 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/48825 [No Types Assigned]
  • Initial Analysis by [email protected]

    Feb. 23, 2009

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

97.21 }} 0.00%

score

0.99861

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: