Adobe Security Bulletin

Security Bulletin for Adobe Acrobat and Reader | APSB18-21

Bulletin ID

Date Published

Priority

APSB18-21

July 10, 2018

2

Summary

Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical and important vulnerabilities.  Successful exploitation could lead to arbitrary code execution in the context of the current user.

Affected Versions

Product

Track

Affected Versions

Platform

Priority rating

Acrobat DC 

Continuous

2018.011.20040 and earlier versions 

Windows and macOS

2

Acrobat Reader DC

Continuous

2018.011.20040 and earlier versions 

Windows and macOS

2

 

 

 

 

 

Acrobat 2017

Classic 2017

2017.011.30080 and earlier versions

Windows and macOS

2

Acrobat Reader 2017

Classic 2017

2017.011.30080 and earlier versions

Windows and macOS

2

 

 

 

 

 

Acrobat DC 

Classic 2015

2015.006.30418 and earlier versions

Windows and macOS

2

Acrobat Reader DC 

Classic 2015

2015.006.30418 and earlier versions

Windows and macOS

2

For questions regarding Acrobat DC, please visit the Acrobat DC FAQ page

For questions regarding Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page.

Solution

Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:

  • Users can update their product installations manually by choosing Help > Check for Updates.
  • The products will update automatically, without requiring user intervention, when updates are
    detected.
  • The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.

For IT administrators (managed environments):

  • Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
  • Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on macOS, Apple Remote Desktop and SSH.

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product

Track

Updated Versions

Platform

Priority Rating

Availability

Acrobat DC

Continuous

2018.011.20055

Windows and macOS

2

Acrobat Reader DC

Continuous

2018.011.20055

Windows and macOS

2

 

 

 

 

 

 

Acrobat 2017

Classic 2017

2017.011.30096

Windows and macOS

2

Acrobat Reader DC 2017

Classic 2017

2017.011.30096

Windows and macOS

2

 

 

 

 

 

 

Acrobat DC

Classic 2015

2015.006.30434

Windows and macOS

2

Acrobat Reader DC

Classic 2015

2015.006.30434

Windows and macOS

2

Note:

As noted in this previous announcement, support for Adobe Acrobat 11.x and Adobe Reader 11.x ended on October 15, 2017.  Version 11.0.23 is the final release for Adobe Acrobat 11.x and Adobe Reader 11.x.  Adobe strongly recommends that you update to the latest versions of Adobe Acrobat DC and Adobe Acrobat Reader DC. By updating installations to the latest versions, you benefit from the latest functional enhancements and improved security measures.

Vulnerability Details

Vulnerability Category

Vulnerability Impact

Severity

CVE Number

Double Free

Arbitrary Code Execution

Critical

CVE-2018-12782

Heap Overflow

Arbitrary Code Execution

Critical

CVE-2018-5015, CVE-2018-5028,   CVE-2018-5032, CVE-2018-5036,   CVE-2018-5038, CVE-2018-5040,   CVE-2018-5041, CVE-2018-5045,   CVE-2018-5052, CVE-2018-5058,   CVE-2018-5067, CVE-2018-12785, CVE-2018-12788, CVE-2018-12798

Use-after-free 

Arbitrary Code Execution

Critical

CVE-2018-5009, CVE-2018-5011,   CVE-2018-5065, CVE-2018-12756, CVE-2018-12770, CVE-2018-12772, CVE-2018-12773, CVE-2018-12776, CVE-2018-12783, CVE-2018-12791, CVE-2018-12792, CVE-2018-12796, CVE-2018-12797  

Out-of-bounds write 

Arbitrary Code Execution

Critical

CVE-2018-5020, CVE-2018-5021,   CVE-2018-5042, CVE-2018-5059,   CVE-2018-5064, CVE-2018-5069,   CVE-2018-5070, CVE-2018-12754, CVE-2018-12755, CVE-2018-12758, CVE-2018-12760, CVE-2018-12771, CVE-2018-12787

Security Bypass

Privilege Escalation

Critical

CVE-2018-12802

Out-of-bounds read

Information Disclosure

Important

CVE-2018-5010, CVE-2018-12803,  CVE-2018-5014, CVE-2018-5016, CVE-2018-5017, CVE-2018-5018, CVE-2018-5019, CVE-2018-5022, CVE-2018-5023, CVE-2018-5024, CVE-2018-5025, CVE-2018-5026, CVE-2018-5027, CVE-2018-5029, CVE-2018-5031, CVE-2018-5033, CVE-2018-5035, CVE-2018-5039, CVE-2018-5044, CVE-2018-5046, CVE-2018-5047, CVE-2018-5048, CVE-2018-5049, CVE-2018-5050, CVE-2018-5051, CVE-2018-5053, CVE-2018-5054, CVE-2018-5055, CVE-2018-5056, CVE-2018-5060, CVE-2018-5061, CVE-2018-5062, CVE-2018-5063, CVE-2018-5066, CVE-2018-5068, CVE-2018-12757, CVE-2018-12761, CVE-2018-12762, CVE-2018-12763, CVE-2018-12764, CVE-2018-12765, CVE-2018-12766, CVE-2018-12767, CVE-2018-12768, CVE-2018-12774, CVE-2018-12777, CVE-2018-12779, CVE-2018-12780, CVE-2018-12781, CVE-2018-12786, CVE-2018-12789, CVE-2018-12790, CVE-2018-12795

Type Confusion

Arbitrary Code Execution

Critical

CVE-2018-5057, CVE-2018-12793, CVE-2018-12794

Untrusted pointer dereference 

Arbitrary Code Execution

Critical

CVE-2018-5012, CVE-2018-5030

Buffer Errors

Arbitrary Code Execution

Critical

CVE-2018-5034, CVE-2018-5037, CVE-2018-5043, CVE-2018-12784

Acknowledgements

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

  • Gal De Leon of Palo Alto Networks (CVE-2018-5009, CVE-2018-5066)

  • Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-12770, CVE-2018-12771, CVE-2018-12772, CVE-2018-12773, CVE-2018-12774, CVE-2018-12776, CVE-2018-12777, CVE-2018-12779, CVE-2018-12780, CVE-2018-12781, CVE-2018-12783,CVE-2018-12795, CVE-2018-12797, CVE-2018-5035)

  • WillJ of Tencent PC Manager via Trend Micro's Zero Day Initiative (CVE-2018-5058, CVE-2018-5063, CVE-2018-5065)

  • Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-5012, CVE-2018-5030, CVE-2018-5033, CVE-2018-5034, CVE-2018-5035, CVE-2018-5059, CVE-2018-5060, CVE-2018-12793, CVE-2018-12796) 

  • Ke Liu of Tencent's Xuanwu LAB working via Trend Micro's Zero Day Initiative (CVE-2018-12803, CVE-2018-5014, CVE-2018-5015, CVE-2018-5016, CVE-2018-5017, CVE-2018-5018, CVE-2018-5019, CVE-2018-5020, CVE-2018-5027, CVE-2018-5028, CVE-2018-5029, CVE-2018-5031, CVE-2018-5032, CVE-2018-5055, CVE-2018-5056, CVE-2018-5057)

  • Sebastian Apelt siberas via Trend Micro's Zero Day Initiative (CVE-2018-12794)

  • Zhiyuan Wang of Chengdu Qihoo360 Tech Co. Ltd. (CVE-2018-12758)

  • Lin Wang of Beihang University (CVE-2018-5010, CVE-2018-5020, CVE-2018-12760, CVE-2018-12761, CVE-2018-12762, CVE-2018-12763, CVE-2018-12787, CVE-2018-5067) 

  • Zhenjie Jia of Qihoo 360 Vulcan Team (CVE-2018-12757)

  • Netanel Ben Simon and Yoav Alon from Check Point Software Technologies (CVE-2018-5063, CVE-2018-5064, CVE-2018-5065, CVE-2018-5068, CVE-2018-5069, CVE-2018-5070, CVE-2018-12754, CVE-2018-12755, CVE-2018-12764, CVE-2018-12765, CVE-2018-12766, CVE-2018-12767. CVE-2018-12768)

  • Aleksandar Nikolic of Cisco Talos (CVE-2018-12756)

  • Vladislav Stolyarov of Kaspersky Lab (CVE-2018-5011) 

  • Ke Liu of Tencent's Xuanwu Lab (CVE-2018-12785, CVE-2018-12786)

  • Kdot via Trend Micro's Zero Day Initiative (CVE-2018-5036, CVE-2018-5037, CVE-2018-5038, CVE-2018-5039, CVE-2018-5040, CVE-2018-5041, CVE-2018-5042, CVE-2018-5043, CVE-2018-5044, CVE-2018-5045, CVE-2018-5046, CVE-2018-5047, CVE-2018-5048, CVE-2018-5049, CVE-2018-5050, CVE-2018-5051, CVE-2018-5052, CVE-2018-5053, CVE-2018-5054)

  • Pengsu Cheng of Trend Micro working with Trend Micro's Zero Day Initiative (CVE-2018-5061, CVE-2018-5067, CVE-2018-12790, CVE-2018-5056)

  • Ron Waisberg working with Trend Micro's Zero Day Initiative (CVE-2018-5062, CVE-2018-12788, CVE-2018-12789) 

  • Steven Seeley (mr_me) of Source Incite working with iDefense Labs (CVE-2018-12791, CVE-2018-12792, CVE-2018-5015)

  • Ashfaq Ansari and Sudhakar Verma - Project Srishti working with iDefense Labs (CVE-2018-12798)

  • XuPeng of TCA/SKLCS Institute of Software Chinese Academy of Sciences and HuangZheng of Baidu Security Lab (CVE-2018-12782)

  • Anonymously reported (CVE-2018-12784, CVE-2018-5009)

  • mr_me of Source Incite working with Trend Micro's Zero Day Initiative (CVE-2018-12761)

  • Zhanglin He and Bo Qu of Palo Alto Networks (CVE-2018-5023, CVE-2018-5024)

  • Bo Qu of Palo Alto Networks and Heige of Knownsec 404 Security Team (CVE-2018-5021, CVE-2018-5022, CVE-2018-5025, CVE-2018-5026)

 Adobe

Dapatkan bantuan lebih cepat dan lebih mudah

Pengguna baru?

Adobe MAX 2024

Adobe MAX
Konferensi Kreativitas

14–16 Oktober Miami Beach dan online

Adobe MAX

Konferensi Kreativitas

14–16 Oktober Miami Beach dan online

Adobe MAX 2024

Adobe MAX
Konferensi Kreativitas

14–16 Oktober Miami Beach dan online

Adobe MAX

Konferensi Kreativitas

14–16 Oktober Miami Beach dan online