Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Adobe has released 13 security patches for Reader and Acrobat.
Critical vulnerabilities patched in Adobe Reader 10.1 and earlier versions for Windows and Macintosh could allow attackers to hijack a system and crash the application.
Patched vulnerabilities that could lead to code execution include local privilege-escalation, a buffer overflow in the U3D TIFF Resource; a heap overflow and three stack overflow flaws in the Adobe image parsing library; three stack overflow vulnerabilities in the Adobe image parsing library; two stack overflow vulnerabilities in the CoolType.dll library; a memory leakage condition vulnerability, and a use-after-free vulnerability.
Affected Adobe Reader and Acrobat product versions range from 10 to 8 for Windows and Mac. Patches were released for Reader 9.4.5 and earlier 9.x versions for Unix.
Adobe said it had not detected exploits against the vulnerabilities in the wild.
The company will cut support for Adobe Reader and Acrobat 8 on 3 November this year.
CVE Numbers
CVE-2011-1353, CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434, CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439, CVE-2011-2440, CVE-2011-2441, CVE-2011-2442
Hi Nate/Darren,
Following last week’s prenotification security advisory, the usual heads-up to let you know that today’s product updates for Adobe Reader and Acrobat will be available within the next 15 minutes:
· Adobe Product Security Incident Report Team (PSIRT) Blog Post: Security updates released for Adobe Reader and Acrobat (APSB11-24) This blog entry will be posted at http://blogs.adobe.com/psirt/2011/09/security-updates-released-for-adobe-reader-and-acrobat-apsb11-24.html.
· Security Bulletin APSB10-28: Security updates available for Adobe Reader and Acrobat The security bulletin will be posted at http://www.adobe.com/support/security/bulletins/apsb11-24.html. (Note: The security bulletin will replace the prenotification security advisory currently posted in this location.)
· Affected Software Versions:
o Adobe Reader X (10.1) and earlier 10.x versions for Windows and Macintosh
o Adobe Reader 9.4.5 and earlier 9.x versions for Windows, Macintosh and UNIX
o Adobe Reader 8.3 and earlier 8.x versions for Windows and Macintosh
o Adobe Acrobat X (10.1) and earlier 10.x versions for Windows and Macintosh
o Adobe Acrobat 9.4.5 and earlier 9.x versions for Windows and Macintosh
o Adobe Acrobat 8.3 and earlier 8.x versions for Windows and Macintosh
· Summary: Critical vulnerabilities have been identified in Adobe Reader X (10.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.2 and earlier versions for UNIX, and Adobe Acrobat X (10.1) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system.
o Adobe recommends users of Adobe Reader X (10.1) and earlier versions for Windows and Macintosh update to Adobe Reader X (10.1.1).
o For users of Adobe Reader 9.4.5 and earlier versions for Windows and Macintosh, who cannot update to Adobe Reader X (10.1.1), Adobe has made available updates, Adobe Reader 9.4.6 and Adobe Reader 8.3.1.
o Adobe recommends users of Adobe Acrobat X (10.1) for Windows and Macintosh update to Adobe Acrobat X (10.1.1).
o Adobe recommends users of Adobe Acrobat 9.4.5 and earlier versions for Windows and Macintosh update to Adobe Acrobat 9.4.6, and users of Adobe Acrobat 8.3 and earlier versions for Windows and Macintosh update to Adobe Acrobat 8.3.1.
o Adobe Reader 9.4.6 for UNIX is currently scheduled to be released on November 7, 2011.
· CVE Numbers (13):
· Exploits: Adobe is not aware of any exploits in the wild for any of the issues patched in this release.
· Additional Notes:
o The next quarterly security updates for Adobe Reader and Acrobat are currently scheduled for December 13, 2011.
o Support for Adobe Reader 8.x and Acrobat 8.x for Windows and Macintosh will end on November 3, 2011. For more information, please see: Adobe Reader and Acrobat 8 End of Support.
If you have any questions, please let me know.
Best,
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.