Adobe · Acrobat and Reader
CVE-2010-2883
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
概要
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
CISA: Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
対処法
Apply updates per vendor instructions.
米国連邦機関の対応期限：2022年6月22日
- CISAのリストに追加
- 2022年6月8日
- 公開日
- 2010年9月9日
- 深刻度
- 高 7.3 CVSS 3.1
- 今後30日間に攻撃される可能性（EPSS）
- 81% 既知の全脆弱性の上位0.4%
- 脆弱性の種類
- CWE-119
- 詳細
- NVD · CVE.org · CISA
すべての参照（19件）
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html
- http://security.gentoo.org/glsa/glsa-201101-08.xml
- http://www.redhat.com/support/errata/RHSA-2010-0743.html
- http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://www.vupen.com/english/advisories/2011/0191
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586
- http://www.adobe.com/support/security/advisories/apsa10-02.html
- http://secunia.com/advisories/43025
- http://www.vupen.com/english/advisories/2011/0344
- http://www.vupen.com/english/advisories/2010/2331
- http://www.kb.cert.org/vuls/id/491991
- http://www.adobe.com/support/security/bulletins/apsb10-21.html
- http://www.us-cert.gov/cas/techalerts/TA10-279A.html
- http://secunia.com/advisories/41340
- http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table…
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61635
- http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html
- http://www.securityfocus.com/bid/43057
Adobeのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/05/20 | Heap-Based Buffer Overflow | Acrobat and Reader | 高 8.8 | 87% |
| 2026/04/13 | Prototype Pollution | Acrobat and Reader | 高 8.6 | 7.3% |
| 2023/10/10 | Use-After-Free | Acrobat and Reader | 高 7.8 | 59% |
| 2023/09/14 | Out-of-Bounds Write | Acrobat and Reader | 高 7.8 | 7.5% |
| 2022/06/08 | Buffer Overflow | Acrobat and Reader | 高 7.8 | 87% |
| 2022/06/08 | Unspecified | Acrobat and Reader | 高 8.8 | 38% |
| 2022/06/08 | Universal 3D Remote Code Execution | Acrobat and Reader | 高 8.8 | 83% |
| 2022/06/08 | Use-After-Free | Acrobat and Reader | 高 7.8 | 82% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。