SB2010041401 - Red Hat update for acroread
Published: April 14, 2010 Updated: May 2, 2017
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2010-0190)
Vulnerability allows a remote authenticated attacker to perform XSS attacks.
The vulnerability is caused by an input validation error in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can trick the victim to open a specially specially crafted PDF file and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Improper input validation (CVE-ID: CVE-2010-0191)
The vulnerability allows remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to input validation error when handling protocol URIs. A remote attacker can create a specially crafted shortcut, trick the victim into clicking it and execute arbitrary commands on the target system with privileges of the current user.
Successful exploitation of the vulnerability may result in system compromise.
3) Input validation error (CVE-ID: CVE-2010-0192)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
4) Input validation error (CVE-ID: CVE-2010-0193)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
5) Input validation error (CVE-ID: CVE-2010-0194)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
6) Memory corruption (CVE-ID: CVE-2010-0195)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to boundary error when processing fonts within PDF files. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
7) Input validation error (CVE-ID: CVE-2010-0196)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
8) Input validation error (CVE-ID: CVE-2010-0197)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
9) Buffer overflow (CVE-ID: CVE-2010-0198)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to boundary error when processing PDF files in Adobe Reader and Acrobat. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.10) Buffer overflow (CVE-ID: CVE-2010-0199)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to boundary error when processing PDF files in Adobe Reader and Acrobat. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.11) Input validation error (CVE-ID: CVE-2010-0201)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
12) Input validation error (CVE-ID: CVE-2010-0202)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
13) Input validation error (CVE-ID: CVE-2010-0203)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
14) Input validation error (CVE-ID: CVE-2010-0204)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing PDF files in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X. A remote attacker can create a specially specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of the vulnerability will result in system compromise.
15) Heap-based buffer overflow (CVE-ID: CVE-2010-1241)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error in the custom heap management system in Adobe Reader and Acrobat. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited in the wild.
Remediation
Install update from vendor's website.