Bug 581417 (CVE-2010-0190, CVE-2010-0191, CVE-2010-0192, CVE-2010-0193, CVE-2010-0194, CVE-2010-0195, CVE-2010-0196, CVE-2010-0197, CVE-2010-0198, CVE-2010-0199, CVE-2010-0201, CVE-2010-0202, CVE-2010-0203, CVE-2010-0204) - Acroread: Multiple code execution flaws (APSB10-09)
Summary: Acroread: Multiple code execution flaws (APSB10-09)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2010-0190, CVE-2010-0191, CVE-2010-0192, CVE-2010-0193, CVE-2010-0194, CVE-2010-0195, CVE-2010-0196, CVE-2010-0197, CVE-2010-0198, CVE-2010-0199, CVE-2010-0201, CVE-2010-0202, CVE-2010-0203, CVE-2010-0204
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://www.adobe.com/support/security...
Whiteboard:
Depends On: 581435 581436
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-12 08:25 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:36 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-04-14 09:50:05 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0349 0 normal SHIPPED_LIVE Critical: acroread security update 2010-04-14 09:36:41 UTC

Description Jan Lieskovsky 2010-04-12 08:25:03 UTC 
Tomorrow, on Tuesday 2010-04-13, Adobe is planning to release
an update for Adobe Reader 9.3.1 and earlier versions, to address
multiple security issues allowing code execution, whose description
is detailed in the Adobe Security Bulletin APSB10-09:

  [1] http://www.adobe.com/support/security/bulletins/apsb10-09.html

This update resolves a cross-site scripting vulnerability that
could lead to code execution (CVE-2010-0190).

This update resolves a prefix protocol handler vulnerability that
could lead to code execution (CVE-2010-0191).

This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-0192).

This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-0193).

This update resolves a memory corruption vulnerability that could
lead to code execution (CVE-2010-0194).

This update resolves a font handling vulnerability that could lead
to code execution (CVE-2010-0195).

This update resolves a denial of service vulnerability; arbitrary code
execution has not been demonstrated, but may be possible (CVE-2010-0196).

This update resolves a memory corruption vulnerability that could
lead to code execution (CVE-2010-0197).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0198).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0199).

This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-0201).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0202).

This update resolves a buffer overflow vulnerability that could lead
to code execution (CVE-2010-0203).

This update resolves a memory corruption vulnerability that could lead
to code execution (CVE-2010-0204).
Comment 2 Vincent Danen 2010-04-13 20:28:41 UTC 
This issue is now public.
Comment 3 errata-xmlrpc 2010-04-14 09:36:47 UTC 
This issue has been addressed in following products:

  Extras for RHEL 4
  Extras for Red Hat Enterprise Linux 5

Via RHSA-2010:0349 https://rhn.redhat.com/errata/RHSA-2010-0349.html
Note You need to log in before you can comment on or make changes to this bug.