Product:
Adobe Reader and Acrobat
Summary
Buffer overflow in Adobe Reader and Acrobat versions before 9.5.4, 10.1.6, and 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document. This vulnerability was actively exploited in the wild in February 2013.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2013-0641 |
Exploitation
To exploit this vulnerability, an attacker can create a specially crafted PDF document that, when opened by a vulnerable version of Adobe Reader or Acrobat, triggers a buffer overflow. This can lead to arbitrary code execution on the victim’s machine, allowing the attacker to gain control over the system.
Affected Products
- Adobe Reader 9.x before 9.5.4
- Adobe Reader 10.x before 10.1.6
- Adobe Reader 11.x before 11.0.02
- Adobe Acrobat 9.x before 9.5.4
- Adobe Acrobat 10.x before 10.1.6
- Adobe Acrobat 11.x before 11.0.02
Mitigation
Users are advised to apply updates as per the vendor’s instructions to mitigate this vulnerability. Keeping software up to date is crucial in protecting against known vulnerabilities.
References
- FireEye Blog
- Adobe Vulnerability Report
- McAfee Labs
- OpenSUSE Security Announcement
- OpenSUSE Security Announcement
- OpenSUSE Security Announcement
- Red Hat Errata
- Gentoo GLSA
- Adobe Security Advisory
- Adobe Security Bulletin
- CERT Vulnerability Database
- CISecurity OVAL Repository
- CISA Known Exploited Vulnerabilities