Adobe Reader < 10.1.10 / 11.0.07 Multiple Vulnerabilities (APSB14-15) (Mac OS X)

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The version of Adobe Reader on the remote Mac OS X host is affected by
multiple vulnerabilities.

Description :

The version of Adobe Reader installed on the remote host is a version
prior to 10.1.10 / 11.0.07. It is, therefore, affected by multiple
vulnerabilities :

- A heap overflow vulnerability exists that could lead to
code execution. (CVE-2014-0511)

- A security bypass vulnerability exists with input
validation. (CVE-2014-0512)

- An information disclosure vulnerability exists with the
JavaScript APIs. (CVE-2014-0521)

- Multiple memory corruption vulnerabilities exists that
could lead to code execution. (CVE-2014-0522,
CVE-2014-0523, CVE-2014-0524, CVE-2014-0526)

- A vulnerability exists with how Reader handles a certain
API call that could lead to code execution.
(CVE-2014-0525)

- A use-after-free vulnerability exists that could lead
to code execution. (CVE-2014-0527)

- A double-free vulnerability exists that could lead to
code execution. (CVE-2014-0528)

- A buffer overflow vulnerability exists that could lead
to code execution. (CVE-2014-0529)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

http://www.securityfocus.com/archive/1/532207/30/0/threaded
https://helpx.adobe.com/security/products/acrobat/apsb14-15.html

Solution :

Upgrade to Adobe Reader 10.1.10 / 11.0.07 or later.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 10.0
(CVSS2#E:ND/RL:U/RC:ND)
Public Exploit Available : true