Detections
Analytics

Adobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15)

critical Nessus Plugin ID 74012

Language:

Synopsis

The version of Adobe Reader on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of Adobe Reader installed on the remote host is a version prior to 10.1.10 / 11.0.07. It is, therefore, affected by multiple vulnerabilities :

 - A heap overflow vulnerability exists that could lead to code execution. (CVE-2014-0511)

 - A security bypass vulnerability exists with input validation. (CVE-2014-0512)

 - An information disclosure vulnerability exists with the JavaScript APIs. (CVE-2014-0521)

 - Multiple memory corruption vulnerabilities exists that could lead to code execution. (CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

 - A vulnerability exists with how Reader handles a certain API call that could lead to code execution.
 (CVE-2014-0525)

 - A use-after-free vulnerability exists that could lead to code execution. (CVE-2014-0527)

 - A double-free vulnerability exists that could lead to code execution. (CVE-2014-0528)

 - A buffer overflow vulnerability exists that could lead to code execution. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Reader 10.1.10 / 11.0.07 or later.

See Also

http://www.securityfocus.com/archive/1/532207/30/0/threaded

https://helpx.adobe.com/security/products/acrobat/apsb14-15.html

Plugin Details

Severity: Critical

ID: 74012

File Name: adobe_reader_apsb14-15.nasl

Version: 1.10

Type: local

Agent: windows

Family: Windows

Published: 5/14/2014

Updated: 6/27/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: SMB/Acroread/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/13/2014

Vulnerability Publication Date: 3/27/2014

Reference Information

CVE: CVE-2014-0511, CVE-2014-0512, CVE-2014-0521, CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0525, CVE-2014-0526, CVE-2014-0527, CVE-2014-0528, CVE-2014-0529

BID: 66205, 66512, 67360, 67362, 67363, 67365, 67366, 67367, 67368, 67369, 67370