[ CVE-2013-0641 · Published 14 Feb 2013 ]
Adobe Reader Buffer Overflow Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS 32%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
- EPSS: 32% chance of exploitation in the next 30 days (higher than 98% of CVEs)
[ Description ]Official description
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
CISA: A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 24 Mar 2022): Apply updates per vendor instructions.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.htmlBroken Link
- blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.htmlBroken LinkVendor Advisory
- blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pd…Broken Link
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.htmlMailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2013-0551.htmlThird Party Advisory
- security.gentoo.org/glsa/glsa-201308-03.xmlThird Party Advisory
- www.adobe.com/support/security/advisories/apsa13-02.htmlVendor Advisory
- www.adobe.com/support/security/bulletins/apsb13-07.htmlBroken Link
- www.kb.cert.org/vuls/id/422807Third Party AdvisoryUS Government Resource
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16296Broken Link
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource