Adobe Reader and Acrobat 8.x before 8.3 on Windows and Mac OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

The version of Adobe Reader installed on the remote Mac OS X host is prior to 10.1, 9.4.5, or 8.3. It is, therefore, affected by the following vulnerabilities :

  - Multiple buffer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2011-2094,     CVE-2011-2095, CVE-2011-2097)

  - A heap overflow condition exists that allows an attacker     to execute arbitrary code. (CVE-2011-2096)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2011-2098,     CVE-2011-2099, CVE-2011-2103, CVE-2011-2105,     CVE-2011-2106)

  - Multiple memory corruption issues exist that allow an     attacker to crash the application. (CVE-2011-2104,     CVE-2011-2105)

  - A DLL loading vulnerability exists that allows an     attacker to execute arbitrary code. (CVE-2011-2100)

  - A cross-document script execution vulnerability exists     that allows an attacker to execute arbitrary code.
    (CVE-2011-2101)

  - A unspecified vulnerability exists that allows an     attacker to bypass security restrictions. (CVE-2011-2102)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote host is earlier than 10.1 / 9.4.5 / 8.3.  Such versions are reportedly affected by multiple vulnerabilities :

  - Multiple buffer overflow vulnerabilities exist that     could lead to code execution. (CVE-2011-2094,     CVE-2011-2095, CVE-2011-2097)

  - A heap overflow vulnerability exists that could lead to     code execution. (CVE-2011-2096)

  - Multiple memory corruption vulnerabilities exist that     could lead to code execution. (CVE-2011-2098,     CVE-2011-2099, CVE-2011-2103, CVE-2011-2105)

  - Multiple memory corruption vulnerabilities exist that     could cause the application to crash. (CVE-2011-2104,     CVE-2011-2105)

  - A DLL loading vulnerability exists that could lead to     code execution. (CVE-2011-2100)

  - A cross document script execution vulnerability exists     that could lead to code execution. (CVE-2011-2101)

  - A security bypass vulnerability exists that could lead     to bypassing security restrictions. (CVE-2011-2102)

The version of Adobe Acrobat installed on the remote host is earlier than 10.1 / 9.4.5 / 8.3.  Such versions are reportedly affected by multiple vulnerabilities :

  - Multiple buffer overflow vulnerabilities exist that     could lead to code execution. (CVE-2011-2094,     CVE-2011-2095, CVE-2011-2097)

  - A heap overflow vulnerability exists that could lead to     code execution. (CVE-2011-2096)

  - Multiple memory corruption vulnerabilities exist that     could lead to code execution. (CVE-2011-2098,     CVE-2011-2099, CVE-2011-2103, CVE-2011-2105)

  - Multiple memory corruption vulnerabilities exist that     could cause the application to crash. (CVE-2011-2104,     CVE-2011-2105)

  - A DLL loading vulnerability exists that could lead to     code execution. (CVE-2011-2100)

  - A cross document script execution vulnerability exists     that could lead to code execution. (CVE-2011-2101)

  - A security bypass vulnerability exists that could lead     to bypassing security restrictions. (CVE-2011-2102)

ID	Name	Product	Family	Severity
55421	Adobe Reader < 10.1 / 9.4.5 / 8.3 Multiple Vulnerabilities (APSB11-12, APSB11-12, APSB11-16) (Mac OS X)	Nessus	MacOS X Local Security Checks	high
55144	Adobe Reader < 10.1 / 9.4.5 / 8.3 Multiple Vulnerabilities (APSB11-16)	Nessus	Windows	high
55143	Adobe Acrobat < 10.1 / 9.4.5 / 8.3 Multiple Vulnerabilities (APSB11-16)	Nessus	Windows	high

Detections

Analytics

CVE-2011-2103

high

Tenable Plugins

high

high

high