Adobe Updates for Multiple Vulnerabilities

Original release date: December 16, 2011
Last revised: --
Source: US-CERT

Systems Affected

• Adobe Reader X (10.1.1) and earlier 10.x versions for Windows and Macintosh
• Adobe Reader 9.4.6 and earlier 9.x versions for Windows, Macintosh, and UNIX
• Adobe Acrobat X (10.1.1) and earlier 10.x versions for Windows and Macintosh
• Adobe Acrobat 9.4.6 and earlier 9.x versions for Windows and Macintosh

Overview

Adobe has released Security Bulletin APSB11-30, which describes multiple vulnerabilities affecting Adobe Reader and Acrobat.

Solution

Update Reader

Adobe has released updates to address this issue. Users are encouraged to read Adobe Security Bulletin APSB11-30 and update vulnerable versions of Adobe Reader and Acrobat.

Do not access PDF files from untrusted sources

Do not open unfamiliar or unexpected PDF files, particularly those hosted on websites or delivered as email attachments. Please see Cyber Security Tip ST04-010.

Description

Adobe Security Bulletin APSB11-30 and Adobe Security Advisory APSA11-04 describe a number of vulnerabilities affecting Adobe Reader and Acrobat. These vulnerabilities affect Reader and Acrobat 9.4.6 and earlier 9.x versions. These vulnerabilities also affect Reader X and Acrobat X 10.1.1 and earlier 10.x versions.

An attacker could exploit these vulnerabilities by convincing a user to open a specially crafted PDF file. The Adobe Reader browser plug-in, which can automatically open PDF documents hosted on a website, is available for multiple web browsers and operating systems.

Adobe Reader X and Adobe Acrobat X will be patched in the next quarterly update scheduled for January 10, 2012.

Additional details for the U3D memory corruption vulnerability can be found in US-CERT Vulnerability Note VU#759307.

References

• Security update available for Adobe Reader and Acrobat - <https://www.adobe.com/support/security/bulletins/apsb11-30.html>
• Adobe Acrobat and Reader U3D memory corruption vulnerability - <http://www.kb.cert.org/vuls/id/759307>
• Security Advisory for Adobe Reader and Acrobat - <https://www.adobe.com/support/security/advisories/apsa11-04.html>

---

Feedback can be directed to US-CERT.

---

Produced 2011 by US-CERT, a government organization. Terms of use

Revision History

December 16, 2011: Initial release