(a.k.a. CVE-2009-2983)
Adobe fixed a bug in various COM objects. Loading and unloading these objects in a webpage in Firefox allows memory corruption, which can be exploited to execute arbitrary code. Here are a number of repro cases for various MIME types:
application/pdf
application/vnd.adobe.xdp+xml
application/vnd.adobe.xfd+xml
application/vnd.adobe.xfdf
application/vnd.fdf
PS. Adobe mentions that “arbitrary code execution has not been demonstrated” without explaining how this is relevant, let me know if you know! 
Leave a Comment