Bug 609203 - (APSB10-15, CVE-2010-1240, CVE-2010-1285, CVE-2010-1295, CVE-2010-2168, CVE-2010-2201, CVE-2010-2202, CVE-2010-2203, CVE-2010-2204, CVE-2010-2205, CVE-2010-2206, CVE-2010-2207, CVE-2010-2208, CVE-2010-2209, CVE-2010-2210, CVE-2010-2211, CVE-2010-2212) acroread: multiple code execution flaws (APSB10-15)
acroread: multiple code execution flaws (APSB10-15)
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Red Hat Product Security
public=20100629,reported=20100629,sou...
: Security
Depends On: 602721 602722
Blocks:
  Show dependency treegraph
 
Reported: 2010-06-29 12:27 EDT by Jan Lieskovsky
Modified: 2010-07-08 12:20 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-07-08 12:20:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2010-06-29 12:27:57 EDT
Today, 2010-06-29, Adobe is planning to release an update
for Adobe Reader of version v9.3.2 and Adobe Acrobat of
version 9.3.2 (new version for both products is v9.3.3),
to address multiple security issues allowing code execution,
whose description is detailed in the Adobe Security Bulletin
APSB10-15:

  [1] http://www.adobe.com/support/security/bulletins/apsb10-15.html

* This update resolves a memory corruption vulnerability that could
  lead to code execution (CVE-2010-1297). Note: There are reports that
  this issue is being actively exploited in the wild.

  Red Hat is tracking this memory corruption vulnerability via a
  dedicated Red Hat Bugzilla entry, which is reachable at:

  [2] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-1297

* This update mitigates a social engineering attack that could lead to
  code execution (CVE-2010-1240).

* This update resolves an invalid pointer vulnerability that could lead
  to code execution (CVE-2010-1285).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-1295).

* This update resolves an invalid pointer vulnerability that could lead
  to code execution (CVE-2010-2168).

* This update resolves an invalid pointer vulnerability that could lead
  to code execution (CVE-2010-2201).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-2202).

* This update resolves a UNIX-only memory corruption vulnerability that
  could lead to code execution (CVE-2010-2203).

* This update resolves a denial of service vulnerability; arbitrary code
  execution has not been demonstrated, but may be possible (CVE-2010-2204).

* This update resolves an uninitialized memory vulnerability that could
  lead to code execution (CVE-2010-2205).

* This update resolves an array-indexing error vulnerability that could
  lead to code execution (CVE-2010-2206).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-2207).

* This update resolves a dereference deleted heap object vulnerability
  that could lead to code execution (CVE-2010-2208).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-2209).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-2210).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-2211).

* This update resolves a memory corruption vulnerability that could lead
  to code execution (CVE-2010-2212).
Comment 3 errata-xmlrpc 2010-06-30 13:47:46 EDT
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0503 https://rhn.redhat.com/errata/RHSA-2010-0503.html

Note You need to log in before you can comment on or make changes to this bug.