Description
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | acroread +1 | 9.3-1.el5 | RHSA-2010:0037 |
| RHEL 4 | acroread +1 | 9.3-1.el4 | RHSA-2010:0038 |
| RHEL 3 | acroread-uninstall | 9.3-3 | RHSA-2010:0060 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Adobe Doc.media.newPlayer Use After Free Vulnerability
exploit/windows/browser/adobe_media_newplayer
-
Adobe Doc.media.newPlayer Use After Free Vulnerability
exploit/windows/fileformat/adobe_media_newplayer
Exploit-DB 3
- Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (2) EDB-16623 · local · Sep 25, 2010 · verified
- Adobe - 'Doc.media.newPlayer' Use-After-Free (Metasploit) (1) EDB-16503 · local · Apr 30, 2010 · verified
- Adobe Reader / Acrobat - '.PDF' File Overflow EDB-10618 · local · Dec 23, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2010:0060 Red Hat Security Advisory: acroread security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0037 Red Hat Security Advisory: acroread security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0038 Red Hat Security Advisory: acroread security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 37331 vdb-entry
- http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html
- 37690 third-party-advisory
- 38138 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=547799
- 60980 vdb-entry
- VU#508357 third-party-advisory
- acro-reader-unspecifed-code-execution(54747) vdb-entry
- ADV-2009-3518 vdb-entry
- http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb
- http://www.adobe.com/support/security/bulletins/apsb10-02.html
- oval:org.mitre.oval:def:6795 vdb-entry signature
- RHSA-2010:0060 vendor-advisory
- http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html
- ADV-2010-0103 vdb-entry
- http://www.adobe.com/support/security/advisories/apsa09-07.html
- http://www.symantec.com/connect/blogs/zero-day-xmas-present
- http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20091214
- 38215 third-party-advisory
- SUSE-SA:2010:008 vendor-advisory
- TA10-013A third-party-advisory