CVE-2009-3958

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow remote attackers to execute arbitrary code via unspecified initialization parameters.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://www.adobe.com/support/security/bulletins/apsb10-02.htmlPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/773545US Government Resource
http://www.securityfocus.com/bid/37759
http://www.securitytracker.com/id?1023446
http://www.us-cert.gov/cas/techalerts/TA10-013A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2010/0103Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55556
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8455
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
http://www.adobe.com/support/security/bulletins/apsb10-02.htmlPatch, Vendor Advisory
http://www.kb.cert.org/vuls/id/773545US Government Resource
http://www.securityfocus.com/bid/37759
http://www.securitytracker.com/id?1023446
http://www.us-cert.gov/cas/techalerts/TA10-013A.htmlUS Government Resource
http://www.vupen.com/english/advisories/2010/0103Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/55556
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8455

Timeline

Published: Jan 13, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-395910.0Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows re CVE-2009-39606.5Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and CVE-2009-39617.5SQL injection vulnerability in user.php in Super Serious Stats (aka superseriousstats) before 1.1.2p1 allows remote attackers to execute arb CVE-2009-39627.8The management interface on the 2wire Gateway 1700HG, 1701HG, 1800HW, 2071, 2700HG, and 2701HG-T with software before 5.29.52 allows remote CVE-2009-39637.5Multiple unspecified vulnerabilities in XOOPS before 2.4.0 Final have unknown impact and attack vectors.CVE-2009-39647.5SQL injection vulnerability in the NinjaMonials (com_ninjacentral) component 1.1.0 for Joomla! allows remote attackers to execute arbitrary CVE-2009-39657.5SQL injection vulnerability in rating.php in New 5 star Rating 1.0 allows remote attackers to execute arbitrary SQL commands via the det par CVE-2009-39667.5Arcade Trade Script 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLoggedIn cookie CVE-2009-39677.5SQL injection vulnerability in browse.php in Ed Charkow SuperCharged Linking allows remote attackers to execute arbitrary SQL commands via t CVE-2009-39687.5Multiple SQL injection vulnerabilities in ITechBids 8.0 allow remote attackers to execute arbitrary SQL commands via the (1) user_id paramet CVE-2009-39699.3Stack-based buffer overflow in Faslo Player 7.0 allows remote attackers to cause a denial of service (application crash) or possibly execute CVE-2009-39706.5SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote authenticated users to e