Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

The version of Adobe Reader installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow condition exists in CoolType.dll due     to improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2014-9160)

  - An out-of-bounds read flaw exists in CoolType.dll due     to improper validation of user-supplied input. A remote     attacker, via a specially crafted PDF file, can cause     the application to crash and disclose memory contents.
    (CVE-2014-9161).

  - Multiple input validation, NULL pointer dereference, and     use-after-free flaws exist that allow memory corruption,     arbitrary code execution, and buffer overflow attacks.
    (CVE-2015-3047,CVE-2015-3048, CVE-2015-3049,     CVE-2015-3050, CVE-2015-3051, CVE-2015-3052,     CVE-2015-3053, CVE-2015-3054, CVE-2015-3055,     CVE-2015-3056, CVE-2015-3057, CVE-2015-3058,     CVE-2015-3059, CVE-2015-3070, CVE-2015-3075,     CVE-2015-3076)

  - Multiple unspecified flaws in the JavaScript API allow     an attacker to bypass JavaScript API restrictions.
    (CVE-2015-3060, CVE-2015-3061, CVE-2015-3062,     CVE-2015-3063, CVE-2015-3064, CVE-2015-3065,     CVE-2015-3066, CVE-2015-3067, CVE-2015-3068,     CVE-2015-3069, CVE-2015-3071, CVE-2015-3072,     CVE-2015-3073, CVE-2015-3074) 

  - An XML external entity injection flaw exists that allows     information disclosure. (CVE-2014-8452)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow condition exists in CoolType.dll due     to improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2014-9160)

  - An out-of-bounds read flaw exists in CoolType.dll due     to improper validation of user-supplied input. A remote     attacker, via a specially crafted PDF file, can cause     the application to crash and disclose memory contents.
    (CVE-2014-9161).

  - Multiple input validation, NULL pointer dereference, and     use-after-free flaws exist that allow memory corruption,     arbitrary code execution, and buffer overflow attacks.
    (CVE-2015-3047,CVE-2015-3048, CVE-2015-3049,     CVE-2015-3050, CVE-2015-3051, CVE-2015-3052,     CVE-2015-3053, CVE-2015-3054, CVE-2015-3055,     CVE-2015-3056, CVE-2015-3057, CVE-2015-3058,     CVE-2015-3059, CVE-2015-3070, CVE-2015-3075,     CVE-2015-3076)

  - Multiple unspecified flaws in the JavaScript API allow     an attacker to bypass JavaScript API restrictions.
    (CVE-2015-3060, CVE-2015-3061, CVE-2015-3062,     CVE-2015-3063, CVE-2015-3064, CVE-2015-3065,     CVE-2015-3066, CVE-2015-3067, CVE-2015-3068,     CVE-2015-3069, CVE-2015-3071, CVE-2015-3072,     CVE-2015-3073, CVE-2015-3074) 

  - An XML external entity injection flaw exists that allows     information disclosure. (CVE-2014-8452) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.14 / 11.0.11. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow condition exists in CoolType.dll due     to improper validation of user-supplied input. A remote     attacker can exploit this to execute arbitrary code.
    (CVE-2014-9160)

  - An out-of-bounds read flaw exists in CoolType.dll due     to improper validation of user-supplied input. A remote     attacker, via a specially crafted PDF file, can cause     the application to crash and disclose memory contents.
    (CVE-2014-9161).

  - Multiple input validation, NULL pointer dereference, and     use-after-free flaws exist that allow memory corruption,     arbitrary code execution, and buffer overflow attacks.
    (CVE-2015-3047,CVE-2015-3048, CVE-2015-3049,     CVE-2015-3050, CVE-2015-3051, CVE-2015-3052,     CVE-2015-3053, CVE-2015-3054, CVE-2015-3055,     CVE-2015-3056, CVE-2015-3057, CVE-2015-3058,     CVE-2015-3059, CVE-2015-3070, CVE-2015-3075,     CVE-2015-3076)

  - Multiple unspecified flaws in the JavaScript API allow     an attacker to bypass JavaScript API restrictions.
    (CVE-2015-3060, CVE-2015-3061, CVE-2015-3062,     CVE-2015-3063, CVE-2015-3064, CVE-2015-3065,     CVE-2015-3066, CVE-2015-3067, CVE-2015-3068,     CVE-2015-3069, CVE-2015-3071, CVE-2015-3072,     CVE-2015-3073, CVE-2015-3074) 

  - An XML external entity injection flaw exists that allows     information disclosure. (CVE-2014-8452)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote host is a version prior to 10.1.13 / 11.0.10. It is, therefore, affected by the following vulnerabilities :

  - Memory corruption errors exist that allow arbitrary code     execution. (CVE-2014-8445, CVE-2014-8446, CVE-2014-8447,     CVE-2014-8456, CVE-2014-8458, CVE-2014-8459,     CVE-2014-8461, CVE-2014-9158)

  - An improperly implemented JavaScript API allows     information disclosure. (CVE-2014-8448, CVE-2014-8451)

  - An integer overflow vulnerability exists that allows     arbitrary code execution. (CVE-2014-8449)

  - An error in handling XML external entities allows     information disclosure. (CVE-2014-8452)

  - A same-origin policy error allows security bypass.
    (CVE-2014-8453)

  - Use-after-free errors exist that allow arbitrary code     execution. (CVE-2014-8454, CVE-2014-8455, CVE-2014-9165)

  - Heap-based buffer overflow flaws exist that allow     arbitrary code execution. (CVE-2014-8457, CVE-2014-8460,     CVE-2014-9159).

  - A time-of-check time-of-use (TOCTOU) race condition     allows arbitrary file system writes. (CVE-2014-9150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote host is a version prior to 10.1.13 / 11.0.10. It is, therefore, affected by the following vulnerabilities :

  - Memory corruption errors exist that allow arbitrary code     execution. (CVE-2014-8445, CVE-2014-8446, CVE-2014-8447,     CVE-2014-8456, CVE-2014-8458, CVE-2014-8459,     CVE-2014-8461, CVE-2014-9158)

  - An improperly implemented JavaScript API allows     information disclosure. (CVE-2014-8448, CVE-2014-8451)

  - An integer overflow vulnerability exists that allows     arbitrary code execution. (CVE-2014-8449)

  - An error in handling XML external entities allows     information disclosure. (CVE-2014-8452)

  - A same-origin policy error allows security bypass.
    (CVE-2014-8453)

  - Use-after-free errors exist that allow arbitrary code     execution. (CVE-2014-8454, CVE-2014-8455, CVE-2014-9165)

  - Heap-based buffer overflow flaws exist that allow     arbitrary code execution. (CVE-2014-8457, CVE-2014-8460,     CVE-2014-9159).

  - A time-of-check time-of-use (TOCTOU) race condition     allows arbitrary file system writes. (CVE-2014-9150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
83473	Adobe Reader < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)	Nessus	MacOS X Local Security Checks	critical
83472	Adobe Acrobat < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)	Nessus	MacOS X Local Security Checks	critical
83471	Adobe Reader < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)	Nessus	Windows	critical
83470	Adobe Acrobat < 10.1.14 / 11.0.11 Multiple Vulnerabilities (APSB15-10)	Nessus	Windows	critical
79858	Adobe Reader < 10.1.13 / 11.0.10 Multiple Vulnerabilities (APSB14-28) (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
79857	Adobe Acrobat < 10.1.13 / 11.0.10 Multiple Vulnerabilities (APSB14-28) (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
79856	Adobe Reader < 10.1.13 / 11.0.10 Multiple Vulnerabilities (APSB14-28)	Nessus	Windows	critical
79855	Adobe Acrobat < 10.1.13 / 11.0.10 Multiple Vulnerabilities (APSB14-28)	Nessus	Windows	critical

Detections

Analytics

CVE-2014-8452

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical