Bug 962931 (CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2724, CVE-2013-2725, CVE-2013-2726, CVE-2013-2727, CVE-2013-2729, CVE-2013-2730, CVE-2013-2731, CVE-2013-2732, CVE-2013-2733, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, CVE-2013-3341, CVE-2013-3346) - acroread: multiple code execution flaws (APSB13-15)
Summary: acroread: multiple code execution flaws (APSB13-15)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2724, CVE-2013-2725, CVE-2013-2726, CVE-2013-2727, CVE-2013-2729, CVE-2013-2730, CVE-2013-2731, CVE-2013-2732, CVE-2013-2733, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, CVE-2013-3341, CVE-2013-3346
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 962943 962944 962945 962946
Blocks: 961684
TreeView+ depends on / blocked
 
Reported: 2013-05-14 19:19 UTC by Vincent Danen
Modified: 2021-02-17 07:41 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-15 14:38:43 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0826 0 normal SHIPPED_LIVE Critical: acroread security update 2013-11-13 16:09:56 UTC

Description Vincent Danen 2013-05-14 19:19:18 UTC 
Adobe security bulletin APSB13-15 describes multiple security flaws that could cause Adobe Acrobat Reader to crash and potentially allow an attacker to take control of the affected system:

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2013-2718, CVE-2013-2719, CVE-2013-2720, CVE-2013-2721, CVE-2013-2722, CVE-2013-2723, CVE-2013-2725, CVE-2013-2726, CVE-2013-2731, CVE-2013-2732, CVE-2013-2734, CVE-2013-2735, CVE-2013-2736, CVE-2013-3337, CVE-2013-3338, CVE-2013-3339, CVE-2013-3340, CVE-2013-3341).

These updates resolve an integer underflow vulnerability that could lead to code execution (CVE-2013-2549).

These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2013-2724).

These updates resolve buffer overflow vulnerabilities that could lead to code execution (CVE-2013-2730, CVE-2013-2733).

These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2013-2727, CVE-2013-2729).


External References:

http://www.adobe.com/support/security/bulletins/apsb13-15.html
Comment 2 errata-xmlrpc 2013-05-15 09:03:37 UTC 
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2013:0826 https://rhn.redhat.com/errata/RHSA-2013-0826.html
Comment 3 Vincent Danen 2013-08-09 04:43:02 UTC 
The bulletin was revised with this note:

August 8, 2013: Added a memory corruption vulnerability (CVE-2013-3346) that was accidentally omitted from the bulletin when originally published.
Note You need to log in before you can comment on or make changes to this bug.