-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Reference: CERT-EU Security Advisory 2012-0001. Title: Security updates available for Adobe Reader and Acrobat Version history: 11.01.2012 Initial publication Summary ======= These updates address critical vulnerabilities (CVE-2011-2462, CVE-2011-4369, CVE-2011-4370, CVE-2011-4371, CVE-2011-4372, CVE-2011-4373) in Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh, and Adobe Acrobat X (10.1.1) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system. These updates include fixes for CVE-2011-2462 and CVE-2011-4369, previously addressed in Adobe Reader and Acrobat 9.x for Windows as referenced in Security Bulletin APSB11-30. See [1] for further details. Remote: Yes Credibility: Vendor Confirmed Easy: Exploit Available CVSSv2 [2] Base Score:10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C) Technical description ============================== Adobe recommends users of Adobe Reader X (10.1.1) and earlier versions for Windows and Macintosh update to Adobe Reader X (10.1.2). For users of Adobe Reader 9.4.7 and earlier versions for Windows and Macintosh, who cannot update to Adobe Reader X (10.1.2), Adobe has made available the update Adobe Reader 9.5. Adobe recommends users of Adobe Acrobat X (10.1.1) for Windows and Macintosh update to Adobe Acrobat X (10.1.2). Adobe recommends users of Adobe Acrobat 9.4.7 and earlier versions for Windows and Macintosh update to Adobe Acrobat 9.5. These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2011-4370). These updates resolve a heap corruption vulnerability that could lead to code execution (CVE-2011-4371). These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2011-4372). These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2011-4373). These updates include fixes for CVE-2011-2462 and CVE-2011-4369, previously addressed in Adobe Reader and Acrobat 9.x for Windows as referenced in Security Bulletin APSB11-30. These updates also incorporate the Adobe Flash Player update as noted in Security Bulletin APSB11-28. Vulnerable systems ================== Adobe Reader X (10.1.1) and earlier 10.x versions for Windows and Macintosh Adobe Reader 9.4.7 and earlier 9.x versions for Windows Adobe Reader 9.4.6 and earlier 9.x versions for Macintosh Adobe Acrobat X (10.1.1) and earlier 10.x versions for Windows and Macintosh Adobe Acrobat 9.4.7 and earlier 9.x versions for Windows Adobe Acrobat 9.4.6 and earlier 9.x versions for Macintosh What can you do? ================ Adobe recommends users update their software installations. See [1] for details. What to tell your users? ======================== Normal security best practices apply. Especially, inform your Web users to be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Users are to be aware not to click on the link in suspicious emails; to immediately forward the suspicious email to the respective IT security officer / contact in your institution. Run your applications with non-privilege account. More information ================ [1] http://www.adobe.com/support/security/bulletins/apsb12-01.html [2] Information about CVSS: http://www.first.org/cvss/cvss-guide.html Best regards, CERT-EU CERT-EU Pre-configuration Team (http://cert.europa.eu) Phone: +32.2.2990005 / e-mail: cert-eu@ec.europa.eu PGP KeyID 0x46AC4383 FP: 9011 6BE9 D642 DD93 8348 DAFA 27A4 06CA 46AC 4383 (DISCLAIMER: CERT-EU, the CERT for the EU institutions, is currently in its setup phase, until May 2012. Services are provided in a pilot fashion, and are not yet fully functional. Announcements, alerts and warnings are sent out in best effort manner, and to contact information currently known to us. We apologise if you are not the correct recipient, or if you had already been warned about this issue from another source . Format, content and way of alerting are subject to change in the future. Contact information or even the team name may change as well.) -----BEGIN PGP SIGNATURE----- Version: BCPG v1.39 iQJXBAEBAgBBBQJPDZagOhxDRVJUIGZvciB0aGUgRXVyb3BlYW4gSW5zdGl0dXRp b25zIDxjZXJ0LWV1QGVjLmV1cm9wYS5ldT4ACgkQJ6QGykasQ4OYAxAAl4ESsCac BGXA/8IS0Zh7ZnZTpvm9+vt61T4Kpwct0m8jFtoBKGFrfRrEaK80C+5unaMoWEH+ tf/hOTKOYvqLm9VlwEBaUWNjOyAL4feUM+lquRNZMbvNuEMToTdyDecvL4GLxrLn 2WFFlLwDOtZS6720/AgYfzPbqDscAzYo4+z8dOmy3Nf9BLMHCIaVLGvptZn5eykI k8y8YxT5IITkJig4qBOO6Zoq0Afhd3aXaqvw6Vfsc/XQ/R7XKUnS8fP9FlootRPx 8ZhVl+8hTSVHzncD764JzCs8B9PH28S3en/6Cz4pijmr93wE45s+c4LS0czTegzx b0Phl0ogMQ7wYA06+z7JMzcRsW0wnsWOWRVVL5I2I/cI0eUofQoYOO4UoSfP7wGj Ypqh4MLDkkV0+EvWf1qsznG3RpAhAipmRVzqdXha2pH6M/GKZ+c5p/HhUWCRfGzJ QAh8wfg5HOGbtiP0zoVwfLIZ8tkhNjHmAfodWKAXXzcm4xKCoCoRcNGSnRN2KeLM x2uKGRsUFitS6th7lWkbGjnXPqmgNUsBi9EbkZluad11BPH6XVMmOkeHrQr8L961 DIpreJguAysXbyFnwrEqPmwNXGG7X14vKxX6ESYzQ8PqxF4mzSeVS9FYcKIWzAbf SYscCFFtgne8uhrFYQdeqjR2YRKmIqYou3o= =yux0 -----END PGP SIGNATURE-----