Adobe · Reader and Acrobat
CVE-2011-2462
Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability
What it is
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
CISA: The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 22, 2022
- Added to the CISA list
- June 8, 2022
- Published
- December 7, 2011
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 89% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-787
- More details
- NVD · CVE.org · CISA
All references (8)
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html
- http://www.redhat.com/support/errata/RHSA-2012-0011.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html
- http://www.adobe.com/support/security/bulletins/apsb12-01.html
- http://www.adobe.com/support/security/advisories/apsa11-04.html
- http://www.adobe.com/support/security/bulletins/apsb11-30.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562
- http://www.us-cert.gov/cas/techalerts/TA11-350A.html
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 25, 2022 | Sandbox Bypass | Reader and Acrobat | High 8.8 | 22% |
| Mar 28, 2022 | Arbitrary Integer Overflow | Reader and Acrobat | High 8.8 | 67% |
| Mar 25, 2022 | Reader and Adobe Acrobat Stack-Based Buffer Overflow | Reader and Acrobat | High 8.8 | 97% |
| Mar 3, 2022 | Arbitrary Code Execution | Reader and Acrobat | High 7.8 | 88% |
| Mar 3, 2022 | Memory Corruption | Reader and Acrobat | High 7.8 | 87% |
| Mar 3, 2022 | Memory Corruption | Reader and Acrobat | High 8.8 | 79% |
| Mar 3, 2022 | Use-After-Free | Reader and Acrobat | High 8.8 | 40% |
| Oct 27, 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critical 9.3 | 31% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.