Adobe · Acrobat and Reader
CVE-2010-2883
Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability
무엇인가
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
CISA: Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 6월 22일
- CISA 목록에 추가됨
- 2022년 6월 8일
- 게시됨
- 2010년 9월 9일
- 심각도
- 높음 7.3 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 81% 알려진 모든 취약점 중 상위 0.4%
- 약점 유형
- CWE-119
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(19)
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html
- http://security.gentoo.org/glsa/glsa-201101-08.xml
- http://www.redhat.com/support/errata/RHSA-2010-0743.html
- http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://www.vupen.com/english/advisories/2011/0191
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586
- http://www.adobe.com/support/security/advisories/apsa10-02.html
- http://secunia.com/advisories/43025
- http://www.vupen.com/english/advisories/2011/0344
- http://www.vupen.com/english/advisories/2010/2331
- http://www.kb.cert.org/vuls/id/491991
- http://www.adobe.com/support/security/bulletins/apsb10-21.html
- http://www.us-cert.gov/cas/techalerts/TA10-279A.html
- http://secunia.com/advisories/41340
- http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table…
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61635
- http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html
- http://www.securityfocus.com/bid/43057
Adobe의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 5. 20. | Heap-Based Buffer Overflow | Acrobat and Reader | 높음 8.8 | 87% |
| 2026. 4. 13. | Prototype Pollution | Acrobat and Reader | 높음 8.6 | 7.2% |
| 2023. 10. 10. | Use-After-Free | Acrobat and Reader | 높음 7.8 | 59% |
| 2023. 9. 14. | Out-of-Bounds Write | Acrobat and Reader | 높음 7.8 | 6.7% |
| 2022. 6. 8. | Buffer Overflow | Acrobat and Reader | 높음 7.8 | 87% |
| 2022. 6. 8. | Unspecified | Acrobat and Reader | 높음 8.8 | 38% |
| 2022. 6. 8. | Universal 3D Remote Code Execution | Acrobat and Reader | 높음 8.8 | 83% |
| 2022. 6. 8. | Use-After-Free | Acrobat and Reader | 높음 7.8 | 82% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.