Product:
Adobe Reader and Acrobat
Summary
Adobe Reader and Acrobat versions before 9.5.4, 10.1.6, and 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service through memory corruption via a crafted PDF document. This vulnerability was actively exploited in the wild in February 2013.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2013-0640 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious PDF document that, when opened by a user with an affected version of Adobe Reader or Acrobat, can lead to arbitrary code execution or a denial of service. The attacker typically needs to deliver the PDF through social engineering techniques, such as email attachments or links to compromised websites, prompting the user to open the document.
Affected Products
- Adobe Reader 9.x before 9.5.4
- Adobe Reader 10.x before 10.1.6
- Adobe Reader 11.x before 11.0.02
- Adobe Acrobat 9.x before 9.5.4
- Adobe Acrobat 10.x before 10.1.6
- Adobe Acrobat 11.x before 11.0.02
Mitigation
Users are advised to apply updates as per the vendor’s instructions to mitigate this vulnerability. Keeping software up to date is crucial in protecting against known vulnerabilities.
References
- FireEye Blog
- Adobe Vulnerability Report
- OpenSUSE Security Announcement
- OpenSUSE Security Announcement
- OpenSUSE Security Announcement
- Red Hat Errata
- Gentoo GLSA
- Adobe Security Advisory
- Adobe Security Bulletin
- CERT Vulnerability Database
- CISecurity OVAL Repository
- CISA Known Exploited Vulnerabilities Catalog