Adobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)

This script is Copyright (C) 2014-2016 Tenable Network Security, Inc.


Synopsis :

The version of Adobe Reader on the remote Mac OS X host is affected by
multiple vulnerabilities.

Description :

The version of Adobe Reader installed on the remote host is a version
prior to 10.1.10 or 11.0.07. It is, therefore, affected by multiple
vulnerabilities :

- A heap overflow condition exists that allows an attacker
to execute arbitrary code. (CVE-2014-0511)

- A security bypass vulnerability exists due to improper
validation of input. (CVE-2014-0512)

- An information disclosure vulnerability exists in the
implementation of the JavaScript APIs. (CVE-2014-0521)

- Multiple memory corruption issues exist that allow an
attacker to execute arbitrary code. (CVE-2014-0522,
CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

- A code execution vulnerability exists due to a failure
to prevent access to unmapped memory. An attacker can
exploit this to execute arbitrary code via unspecified
API calls. (CVE-2014-0525)

- A use-after-free error exists that allows an attacker to
execute arbitrary code. (CVE-2014-0527)

- A double-free error exists that allows an attacker to
execute arbitrary code. (CVE-2014-0528)

- A buffer overflow condition exists that allows an
attacker to execute arbitrary code. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

http://www.securityfocus.com/archive/1/532207/30/0/threaded
https://helpx.adobe.com/security/products/acrobat/apsb14-15.html

Solution :

Upgrade to Adobe Reader version 10.1.10 / 11.0.07 or later.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 9.0
(CVSS2#E:POC/RL:U/RC:ND)
Public Exploit Available : true