CVE-2009-1492

The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.

• CWE-399

• http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.htmlVendor Advisory
• http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.htmlVendor Advisory
• http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlMailing List, Third Party Advisory
• http://osvdb.org/54130Broken Link
• http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txtExploit, Third Party Advisory
• http://secunia.com/advisories/34924Third Party Advisory
• http://secunia.com/advisories/35055Third Party Advisory
• http://secunia.com/advisories/35096Third Party Advisory
• http://secunia.com/advisories/35152Third Party Advisory
• http://secunia.com/advisories/35358Third Party Advisory
• http://secunia.com/advisories/35416Third Party Advisory
• http://secunia.com/advisories/35734Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200907-06.xmlThird Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1Broken Link
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953Third Party Advisory
• http://www.adobe.com/support/security/bulletins/apsb09-06.htmlVendor Advisory
• http://www.kb.cert.org/vuls/id/970180Third Party Advisory, US Government Resource
• http://www.redhat.com/support/errata/RHSA-2009-0478.htmlThird Party Advisory
• http://www.securityfocus.com/bid/34736Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022139Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA09-133B.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2009/1189Third Party Advisory
• http://www.vupen.com/english/advisories/2009/1317Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50145Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/8569Third Party Advisory, VDB Entry
• http://blogs.adobe.com/psirt/2009/04/potential_adobe_reader_issue.htmlVendor Advisory
• http://blogs.adobe.com/psirt/2009/04/update_on_adobe_reader_issue.htmlVendor Advisory
• http://blogs.adobe.com/psirt/2009/05/adobe_reader_issue_update.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlMailing List, Third Party Advisory
• http://osvdb.org/54130Broken Link
• http://packetstorm.linuxsecurity.com/0904-exploits/getannots.txtExploit, Third Party Advisory
• http://secunia.com/advisories/34924Third Party Advisory
• http://secunia.com/advisories/35055Third Party Advisory
• http://secunia.com/advisories/35096Third Party Advisory
• http://secunia.com/advisories/35152Third Party Advisory
• http://secunia.com/advisories/35358Third Party Advisory
• http://secunia.com/advisories/35416Third Party Advisory
• http://secunia.com/advisories/35734Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200907-06.xmlThird Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259028-1Broken Link
• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=926953Third Party Advisory
• http://www.adobe.com/support/security/bulletins/apsb09-06.htmlVendor Advisory
• http://www.kb.cert.org/vuls/id/970180Third Party Advisory, US Government Resource
• http://www.redhat.com/support/errata/RHSA-2009-0478.htmlThird Party Advisory
• http://www.securityfocus.com/bid/34736Exploit, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1022139Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA09-133B.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2009/1189Third Party Advisory
• http://www.vupen.com/english/advisories/2009/1317Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50145Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/8569Third Party Advisory, VDB Entry

Published

Apr 30, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-1486Directory traversal vulnerability in pmscript.php in Flatcha…
• CVE-2009-1487SQL injection vulnerability in pages/login.php in FunGamez R…
• CVE-2009-1488Directory traversal vulnerability in admin/load.php in FunGa…
• CVE-2009-1489includes/user.php in Fungamez RC1 allows remote attackers to…
• CVE-2009-1490Heap-based buffer overflow in Sendmail before 8.13.2 allows …
• CVE-2009-1491McAfee GroupShield for Microsoft Exchange on Exchange Server…
• CVE-2009-1493The customDictionaryOpen spell method in the JavaScript API …
• CVE-2009-1494The process_stat function in Memcached 1.2.8 discloses memor…
• CVE-2009-1495Web File Explorer 3.1 stores sensitive information under the…
• CVE-2009-1496Directory traversal vulnerability in the Cmi Marketplace (co…
• CVE-2009-1497Stack-based buffer overflow in srt2smi.exe in Gretech Online…
• CVE-2009-1498Directory traversal vulnerability in inc/profilemain.php in …