Adobe · Reader and Acrobat
CVE-2013-2729
Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
Exploited in attacks
High 8.8 Attack chance: 67%
What it is
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.
CISA: Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 18, 2022
- Added to the CISA list
- March 28, 2022
- Published
- May 16, 2013
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 67% in the top 0.7% of all known vulnerabilities
- Weakness
- CWE-189
- More details
- NVD · CVE.org · CISA
All references (5)
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2013-0826.html
- http://security.gentoo.org/glsa/glsa-201308-03.xml
- http://www.adobe.com/support/security/bulletins/apsb13-15.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16717
More exploited flaws from Adobe
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 8, 2022 | Universal 3D Memory Corruption | Reader and Acrobat | High 8.8 | 89% |
| May 25, 2022 | Sandbox Bypass | Reader and Acrobat | High 8.8 | 22% |
| Mar 25, 2022 | Reader and Adobe Acrobat Stack-Based Buffer Overflow | Reader and Acrobat | High 8.8 | 97% |
| Mar 3, 2022 | Arbitrary Code Execution | Reader and Acrobat | High 7.8 | 88% |
| Mar 3, 2022 | Memory Corruption | Reader and Acrobat | High 7.8 | 87% |
| Mar 3, 2022 | Memory Corruption | Reader and Acrobat | High 8.8 | 79% |
| Mar 3, 2022 | Use-After-Free | Reader and Acrobat | High 8.8 | 40% |
| Oct 27, 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Critical 9.3 | 31% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.