CVE-2009-0520

Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a "buffer overflow issue."

• CWE-119

• http://isc.sans.org/diary.html?storyid=5929Patch
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773
• http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2009-0332.html
• http://rhn.redhat.com/errata/RHSA-2009-0334.html
• http://secunia.com/advisories/34012
• http://secunia.com/advisories/34226
• http://secunia.com/advisories/34293
• http://secunia.com/advisories/35074
• http://security.gentoo.org/glsa/glsa-200903-23.xml
• http://securitytracker.com/id?1021750
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-254909-1
• http://support.apple.com/kb/HT3549
• http://www.adobe.com/support/security/bulletins/apsb09-01.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/33880Patch
• http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/0513Patch
• http://www.vupen.com/english/advisories/2009/0743
• http://www.vupen.com/english/advisories/2009/1297
• https://bugzilla.redhat.com/show_bug.cgi?id=487142
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48887
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16057
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6593
• http://isc.sans.org/diary.html?storyid=5929Patch
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773
• http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
• http://rhn.redhat.com/errata/RHSA-2009-0332.html
• http://rhn.redhat.com/errata/RHSA-2009-0334.html
• http://secunia.com/advisories/34012
• http://secunia.com/advisories/34226
• http://secunia.com/advisories/34293
• http://secunia.com/advisories/35074
• http://security.gentoo.org/glsa/glsa-200903-23.xml
• http://securitytracker.com/id?1021750
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-254909-1
• http://support.apple.com/kb/HT3549
• http://www.adobe.com/support/security/bulletins/apsb09-01.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/bid/33880Patch
• http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2009/0513Patch
• http://www.vupen.com/english/advisories/2009/0743
• http://www.vupen.com/english/advisories/2009/1297
• https://bugzilla.redhat.com/show_bug.cgi?id=487142
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48887
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16057
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6593

Published

Feb 26, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0514Multiple directory traversal vulnerabilities in WebFrame 0.7…
• CVE-2009-0515Directory traversal vulnerability in check_lang.php in Yet A…
• CVE-2009-0516SQL injection vulnerability in the classified page (classifi…
• CVE-2009-0517Eval injection vulnerability in index.php in phpSlash 0.8.1.…
• CVE-2009-0518VI Client in VMware VirtualCenter before 2.5 Update 4, VMwar…
• CVE-2009-0519Unspecified vulnerability in Adobe Flash Player 9.x before 9…
• CVE-2009-0521Untrusted search path vulnerability in Adobe Flash Player 9.…
• CVE-2009-0522Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0…
• CVE-2009-0523Cross-site scripting (XSS) vulnerability in Adobe RoboHelp S…
• CVE-2009-0524Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 6…
• CVE-2009-0525Cross-site scripting (XSS) vulnerability in the sajax_get_co…
• CVE-2009-0526Multiple cross-site scripting (XSS) vulnerabilities in index…