Bug 581417 (CVE-2010-0190, CVE-2010-0191, CVE-2010-0192, CVE-2010-0193, CVE-2010-0194, CVE-2010-0195, CVE-2010-0196, CVE-2010-0197, CVE-2010-0198, CVE-2010-0199, CVE-2010-0201, CVE-2010-0202, CVE-2010-0203, CVE-2010-0204)

Summary: Acroread: Multiple code execution flaws (APSB10-09)
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: mkasik, security-response-team, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.adobe.com/support/security/bulletins/apsb10-09.html
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-04-14 09:50:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 581435, 581436    
Bug Blocks:    

Description Jan Lieskovsky 2010-04-12 08:25:03 UTC 
Tomorrow, on Tuesday 2010-04-13, Adobe is planning to release
an update for Adobe Reader 9.3.1 and earlier versions, to address
multiple security issues allowing code execution, whose description
is detailed in the Adobe Security Bulletin APSB10-09:

  [1] http://www.adobe.com/support/security/bulletins/apsb10-09.html

This update resolves a cross-site scripting vulnerability that
could lead to code execution (CVE-2010-0190).

This update resolves a prefix protocol handler vulnerability that
could lead to code execution (CVE-2010-0191).

This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-0192).

This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-0193).

This update resolves a memory corruption vulnerability that could
lead to code execution (CVE-2010-0194).

This update resolves a font handling vulnerability that could lead
to code execution (CVE-2010-0195).

This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-0196).

This update resolves a memory corruption vulnerability that could
lead to code execution (CVE-2010-0197).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0198).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0199).

This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-0201).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0202).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0203).

This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-0204).
Comment 2 Vincent Danen 2010-04-13 20:28:41 UTC 
This issue is now public.
Comment 3 errata-xmlrpc 2010-04-14 09:36:47 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0349 https://rhn.redhat.com/errata/RHSA-2010-0349.html