GLSA-200910-03 : Adobe Reader: Multiple vulnerabilities
high Nessus Plugin ID 42239
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 9
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-200910-03 (Adobe Reader: Multiple vulnerabilities)Multiple vulnerabilities were discovered in Adobe Reader. For further information please consult the CVE entries and the Adobe Security Bulletin referenced below.
Impact :
A remote attacker might entice a user to open a specially crafted PDF file, possibly resulting in the execution of arbitrary code with the privileges of the user running the application, Denial of Service, the creation of arbitrary files on the victim's system, 'Trust Manager' bypass, or social engineering attacks.
Workaround :
There is no known workaround at this time.
Solution
All Adobe Reader users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose '>=app-text/acroread-9.2'
See Also
https://www.adobe.com/support/security/bulletins/apsb09-15.html
Plugin Details
Severity: High
ID: 42239
File Name: gentoo_GLSA-200910-03.nasl
Version: 1.30
Type: local
Family: Gentoo Local Security Checks
Published: 10/26/2009
Updated: 1/6/2021
Dependencies: ssh_get_info.nasl
Risk Information
Risk Factor: High
VPR Score: 9
CVSS v2.0
Base Score: 9.3
Temporal Score: 8.1
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:H/RL:OF/RC:C
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:acroread, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/25/2009
Exploitable With
Core Impact
Metasploit (Adobe FlateDecode Stream Predictor 02 Integer Overflow)
Reference Information
CVE: CVE-2007-0045, CVE-2007-0048, CVE-2009-2979, CVE-2009-2980, CVE-2009-2981, CVE-2009-2982, CVE-2009-2983, CVE-2009-2985, CVE-2009-2986, CVE-2009-2988, CVE-2009-2990, CVE-2009-2991, CVE-2009-2993, CVE-2009-2994, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998, CVE-2009-3431, CVE-2009-3458, CVE-2009-3459, CVE-2009-3462
BID: 21858, 35148, 36600, 36664, 36665, 36667, 36668, 36669, 36671, 36677, 36678, 36681, 36682, 36686, 36687, 36688, 36689, 36690, 36692, 36695, 36696