Adobe Reader and Acrobat Memory Corruption Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
• EPSS: 87% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

CISA: An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.htmlBroken Link
• blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.htmlBroken Link
• lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.htmlMailing ListThird Party Advisory
• rhn.redhat.com/errata/RHSA-2013-0551.htmlThird Party Advisory
• security.gentoo.org/glsa/glsa-201308-03.xmlThird Party Advisory
• www.adobe.com/support/security/advisories/apsa13-02.htmlVendor Advisory
• www.adobe.com/support/security/bulletins/apsb13-07.htmlBroken Link
• www.kb.cert.org/vuls/id/422807Third Party AdvisoryUS Government Resource
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16406Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource