KLA10440 Multiple vulnerabilities in Adobe Acrobat & Reader

Multiple critical vulnerabilities have been found in Adobe Acrobat and Reader. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, obtain sensitive information, execute arbitrary code and read arbitrary files.

Below is a complete list of vulnerabilities

1. use-after-free vulnerability can be exploited via unspecified vectors;
2. Unknown vectors can be exploited via XML external entity declaration;
3. Race conditions can be exploited via an NTFS junction;
4. Unknown vectors can be exploited via JavaScript API;
5. An integer overflow can be exploited via unspecified vectors;
6. Unlnown vectors can be exploited remotely;
7. Heap based buffer overflow can be exploited via unknown vectors.

Original advisories

APSB

Related products

Adobe-Reader

Adobe-Acrobat

Adobe-Reader-X

Adobe-Acrobat-X

Adobe-Reader-XI

Adobe-Acrobat-XI

CVE list

CVE-2014-8445 critical

CVE-2014-9165 critical

CVE-2014-8452 critical

CVE-2014-8453 critical

CVE-2014-9150 high

CVE-2014-8446 critical

CVE-2014-8447 critical

CVE-2014-8448 critical

CVE-2014-8456 critical

CVE-2014-8454 critical

CVE-2014-8455 critical

CVE-2014-8451 critical

CVE-2014-8449 critical

CVE-2014-8457 critical

CVE-2014-8458 critical

CVE-2014-8460 critical

CVE-2014-8459 critical

CVE-2014-8461 critical

CVE-2014-9158 critical

CVE-2014-9159 critical

Solution

Update to latest version

Get reader

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Adobe Reader XI 11.0.09 and earlierAdobe Reader X 10.1.12 and earlierAdobe Acrobat XI 11.0.09 and earlierAdobe Acrobat X 10.1.12 and earlier