Detections
Analytics

Adobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)

critical Nessus Plugin ID 74014

Language:

Synopsis

The version of Adobe Reader on the remote Mac OS X host is affected by multiple vulnerabilities.

Description

The version of Adobe Reader installed on the remote host is a version prior to 10.1.10 or 11.0.07. It is, therefore, affected by multiple vulnerabilities :

 - A heap overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2014-0511)

 - A security bypass vulnerability exists due to improper validation of input. (CVE-2014-0512)

 - An information disclosure vulnerability exists in the implementation of the JavaScript APIs. (CVE-2014-0521)

 - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

 - A code execution vulnerability exists due to a failure to prevent access to unmapped memory. An attacker can exploit this to execute arbitrary code via unspecified API calls. (CVE-2014-0525)

 - A use-after-free error exists that allows an attacker to execute arbitrary code. (CVE-2014-0527)

 - A double-free error exists that allows an attacker to execute arbitrary code. (CVE-2014-0528)

 - A buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Reader version 10.1.10 / 11.0.07 or later.

See Also

http://www.securityfocus.com/archive/1/532207/30/0/threaded

https://helpx.adobe.com/security/products/acrobat/apsb14-15.html

Plugin Details

Severity: Critical

ID: 74014

File Name: macosx_adobe_reader_apsb14-15.nasl

Version: 1.10

Type: local

Agent: macosx

Published: 5/14/2014

Updated: 7/14/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, installed_sw/Adobe Reader

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/13/2014

Vulnerability Publication Date: 3/27/2014

Reference Information

CVE: CVE-2014-0511, CVE-2014-0512, CVE-2014-0521, CVE-2014-0522, CVE-2014-0523, CVE-2014-0524, CVE-2014-0525, CVE-2014-0526, CVE-2014-0527, CVE-2014-0528, CVE-2014-0529

BID: 66205, 66512, 67360, 67362, 67363, 67365, 67366, 67367, 67368, 67369, 67370