Adobe · Acrobat and Reader
CVE-2010-2883
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
Cos'è
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
CISA: Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 22 giugno 2022
- Aggiunta all'elenco CISA
- 8 giugno 2022
- Pubblicato
- 9 settembre 2010
- Gravità
- Alta 7,3 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 81% tra il 0,4% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-119
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (19)
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html
- http://security.gentoo.org/glsa/glsa-201101-08.xml
- http://www.redhat.com/support/errata/RHSA-2010-0743.html
- http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://www.vupen.com/english/advisories/2011/0191
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586
- http://www.adobe.com/support/security/advisories/apsa10-02.html
- http://secunia.com/advisories/43025
- http://www.vupen.com/english/advisories/2011/0344
- http://www.vupen.com/english/advisories/2010/2331
- http://www.kb.cert.org/vuls/id/491991
- http://www.adobe.com/support/security/bulletins/apsb10-21.html
- http://www.us-cert.gov/cas/techalerts/TA10-279A.html
- http://secunia.com/advisories/41340
- http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table…
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61635
- http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html
- http://www.securityfocus.com/bid/43057
Altre falle sfruttate di Adobe
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 20 mag 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | Alta 8,8 | 87% |
| 13 apr 2026 | Prototype Pollution | Acrobat and Reader | Alta 8,6 | 7,2% |
| 10 ott 2023 | Use-After-Free | Acrobat and Reader | Alta 7,8 | 59% |
| 14 set 2023 | Out-of-Bounds Write | Acrobat and Reader | Alta 7,8 | 6,7% |
| 8 giu 2022 | Buffer Overflow | Acrobat and Reader | Alta 7,8 | 87% |
| 8 giu 2022 | Unspecified | Acrobat and Reader | Alta 8,8 | 38% |
| 8 giu 2022 | Universal 3D Remote Code Execution | Acrobat and Reader | Alta 8,8 | 83% |
| 8 giu 2022 | Use-After-Free | Acrobat and Reader | Alta 7,8 | 82% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.