CVE-2012-0724, CVE-2012-0725, CVE-2012-0751, CVE-2012-0752, CVE-2012-0753, CVE-2012-0754, CVE-2012-0755, CVE-2012-0756, CVE-2012-0767, CVE-2012-0768, CVE-2012-0769, CVE-2012-0772, CVE-2012-0773, CVE-2012-0774, CVE-2012-0775, CVE-2012-0776, CVE-2012-0777
11 Apr 2012
19 Apr 2012
Adobe Acrobat 9.x
This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.
Cross-Site Scripting vulnerabilities allow a third party to manipulate the content or behaviour of a web application in a user's browser, without compromising the underlying system.
Different Cross-Site Scripting related vulnerabilities are also classified under this category, including "script insertion" and "cross-site request forgery".
Cross-Site Scripting vulnerabilities are often used against specific users of a website to steal their credentials or to conduct spoofing attacks.
Exposure of sensitive information
Vulnerabilities where documents or credentials are leaked or can be revealed either locally or from remote.
This covers vulnerabilities or security issues where malicious users or people can bypass certain security mechanisms of the application.
The actual impact varies significantly depending on the design and purpose of the affected application.
Multiple vulnerabilities have been reported in Adobe Reader and Adobe Acrobat, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, gain knowledge of potentially sensitive information, and compromise a user's system.
1) An integer overflow error when handling Control Value Table (cvt) streams containing a MINDEX opcode (0x26) can be exploited to cause a buffer overflow by e.g. tricking a user into opening a malicious PDF file containing specially crafted embedded TrueType Fonts (TTF).
3) The application loads executables (e.g. msiexec.exe) in an insecure manner. This can be exploited to run an arbitrary program by tricking a user into e.g. opening a file located on a remote WebDAV or SMB share and repairing the installation.
NOTE: This vulnerability affects the Macintosh and Linux versions only.
5) The application bundles a vulnerable version of Adobe Flash Player.
NOTE: This vulnerability affects Adobe Reader X and Adobe Acrobat X only.
Successful exploitation of vulnerabilities #1 - #4 may allow execution of arbitrary code.
The vulnerabilities are reported in the following products:
Adobe Reader X versions 10.1.2 and prior for Windows and Macintosh:
Adobe Reader versions 9.5 and prior for Windows and Macintosh:
Adobe Reader versions 9.4.6 and prior for Linux:
Adobe Acrobat X versions 10.1.2 and prior for Windows and Macintosh:
Adobe Acrobat versions 9.5 and prior for Windows and Macintosh:
1) Peter Vreugdenhil, HP DVLabs
The vendor credits: