{"id":"CVE-2009-0520","aliases":["EUVD-2009-0524","GHSA-8fmr-hfvg-xqm4","RHSA-2009:0332","RHSA-2009:0334"],"status":"published","title":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove...","description":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a \"buffer overflow issue.\"","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.28484,"percentile":0.98142,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2009-02-26T16:00:00Z","modified":"2026-06-29T10:02:16Z","exploits":[{"source":"exploitdb","id":"EDB-32811","title":"Adobe Flash Player 9/10 - Invalid Object Reference Remote Code Execution","type":"remote","platform":"unix","date":"2009-02-24","verified":true,"url":"https://www.exploit-db.com/exploits/32811"}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.22.87-1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.0.22.87-1.el5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:3","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.159.0-1.el3.with.oss"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:4","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.159.0-1.el4"}]}],"bundled":2}],"products":[{"vendor":"adobe","product":"air"},{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_for_linux"},{"vendor":"adobe","product":"flex"}],"references":[{"url":"http://isc.sans.org/diary.html?storyid=5929","tags":["x_refsource_MISC","x_transferred","Patch"]},{"url":"http://support.apple.com/kb/HT3549","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2009-0332.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=773","tags":["third-party-advisory","x_refsource_IDEFENSE","x_transferred"]},{"url":"http://secunia.com/advisories/35074","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/34226","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6593","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/48887","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2009/0743","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb09-01.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","article"]},{"url":"http://www.vupen.com/english/advisories/2009/0513","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch"]},{"url":"http://security.gentoo.org/glsa/glsa-200903-23.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-133A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","US Government Resource"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16057","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2009/1297","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/33880","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch"]},{"url":"http://securitytracker.com/id?1021750","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://secunia.com/advisories/34293","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-254909-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2009-0334.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=487142","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://secunia.com/advisories/34012","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0520","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8fmr-hfvg-xqm4"},{"url":"https://access.redhat.com/errata/RHSA-2009:0332","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://www.adobe.com/products/flashplayer/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=487141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=487144","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0332.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0519","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0519","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0520","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0520","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0521","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:0334","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0334.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-0520","description":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a \"buffer overflow issue.\"","status":"published","published":"2009-02-26T16:00:00Z","modified":"2024-08-07T04:40:03.744Z","updated_at":"2026-11-02T14:33:26.302774Z"}],"euvd":[{"id":"EUVD-2009-0524","description":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a \"buffer overflow issue.\"","status":"published","published":"2009-02-26T16:00:00Z","modified":"2024-08-07T04:40:03Z","updated_at":"2026-11-03T01:39:25.63342Z"}],"ghsa":[{"id":"GHSA-8fmr-hfvg-xqm4","title":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove...","description":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a \"buffer overflow issue.\"","status":"published","published":"2022-05-02T03:16:15Z","modified":"2023-01-31T05:07:36Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:49:14.611815Z"}],"nvd":[{"id":"CVE-2009-0520","description":"Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave Flash file processing, which allows remote attackers to execute arbitrary code via a crafted file, related to a \"buffer overflow issue.\"","status":"published","published":"2009-02-26T16:17:19.89Z","modified":"2026-06-16T23:05:13.187Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:01:34.44527Z"}],"osv":[{"id":"RHSA-2009:0332","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T06:45:10Z","modified":"2026-06-29T10:02:15Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:0334","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T06:45:15Z","modified":"2026-06-29T10:02:16Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}