Bulletin ID
Security Bulletin for Adobe Acrobat and Reader | APSB18-41
|
Date Published |
Priority |
---|---|---|
APSB18-41 |
December 11, 2018 |
2 |
Summary
Affected Versions
Solution
Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are detected.
- The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.
For IT administrators (managed environments):
- Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
- Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on macOS, Apple Remote Desktop and SSH.
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
Track |
Updated Versions |
Platform |
Priority Rating |
Availability |
|
Acrobat DC |
Continuous |
2019.010.20064 |
Windows and macOS |
2 |
|
Acrobat Reader DC |
Continuous |
2019.010.20064 |
Windows and macOS |
2 |
|
|
|
|
|
|
|
Acrobat 2017 |
Classic 2017 |
2017.011.30110 |
Windows and macOS |
2 |
|
Acrobat Reader DC 2017 |
Classic 2017 |
2017.011.30110 |
Windows and macOS |
2 |
|
|
|
|
|
|
|
Acrobat DC |
Classic 2015 |
2015.006.30461 |
Windows and macOS |
2 |
|
Acrobat Reader DC |
Classic 2015 |
2015.006.30461 |
Windows and macOS |
2 |
Vulnerability Details
Vulnerability Impact |
Severity |
CVE Number |
|
---|---|---|---|
Buffer Errors
|
Arbitrary Code Execution
|
Critical
|
CVE-2018-15998 CVE-2018-15987 |
Untrusted pointer dereference |
Arbitrary Code Execution
|
Critical
|
CVE-2018-16004 CVE-2018-19720 |
Security Bypass
|
Privilege Escalation
|
Critical
|
CVE-2018-16045 CVE-2018-16044 |
Use After Free
|
Arbitrary Code Execution
|
Critical
|
CVE-2018-19715 CVE-2018-19713 CVE-2018-19708 CVE-2018-19707 CVE-2018-19700 CVE-2018-19698 CVE-2018-16046 CVE-2018-16040 CVE-2018-16039 CVE-2018-16037 CVE-2018-16036 CVE-2018-16029 CVE-2018-16027 CVE-2018-16026 CVE-2018-16025 CVE-2018-16014 CVE-2018-16008 CVE-2018-16003 CVE-2018-15994 CVE-2018-15993 CVE-2018-15992 CVE-2018-15991 CVE-2018-15990 |
Out-of-bounds write
|
Arbitrary Code Execution
|
Critical
|
CVE-2018-19702 CVE-2018-16016 CVE-2018-16000 CVE-2018-15999 CVE-2018-15988 |
Heap Overflow
|
Arbitrary Code Execution
|
Critical
|
CVE-2018-19716 CVE-2018-16021 CVE-2018-12830 |
Out-of-bounds read
|
Information Disclosure
|
Important
|
CVE-2018-19717 CVE-2018-19714 CVE-2018-19712 CVE-2018-19711 CVE-2018-19710 CVE-2018-19709 CVE-2018-19706 CVE-2018-19705 CVE-2018-19704 CVE-2018-19703 CVE-2018-19701 CVE-2018-19699 CVE-2018-16047 CVE-2018-16043 CVE-2018-16041 CVE-2018-16038 CVE-2018-16035 CVE-2018-16034 CVE-2018-16033 CVE-2018-16032 CVE-2018-16031 CVE-2018-16030 CVE-2018-16028 CVE-2018-16024 CVE-2018-16023 CVE-2018-16022 CVE-2018-16020 CVE-2018-16019 CVE-2018-16017 CVE-2018-16015 CVE-2018-16013 CVE-2018-16012 CVE-2018-16010 CVE-2018-16006 CVE-2018-16005 CVE-2018-16002 CVE-2018-16001 CVE-2018-15997 CVE-2018-15996 CVE-2018-15989 CVE-2018-15985 CVE-2018-15984 CVE-2018-19719 CVE-2018-19728 |
Integer Overflow |
Information Disclosure
|
Important
|
CVE-2018-16009 CVE-2018-16007 CVE-2018-15995 CVE-2018-15986 |
Security Bypass |
Information Disclosure |
Important |
CVE-2018-16042 |
Acknowledgements
Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:
Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-16029, CVE-2018-16027, CVE-2018-16025, CVE-2018-15997, CVE-2018-15992)
Ke Liu of Tencent's Xuanwu Lab (CVE-2018-19706, CVE-2018-19705, CVE-2018-19704, CVE-2018-19703, CVE-2018-19702, CVE-2018-16035, CVE-2018-16020, CVE-2018-16019, CVE-2018-16016, CVE-2018-16015, CVE-2018-16013, CVE-2018-15990, CVE-2018-15988).
kdot working with Trend Micro's Zero Day Initiative (CVE-2018-19712, CVE-2018-19711, CVE-2018-16030, CVE-2018-16028, CVE-2018-16012, CVE-2018-16002, CVE-2018-16001, CVE-2018-15996, CVE-2018-19728)
Esteban Ruiz (mr_me) of Source Incite via Trend Micro's Zero Day Initiative (CVE-2018-16026, CVE-2018-15994, CVE-2018-15993, CVE-2018-15991, CVE-2018-16008).
Du pingxin From NSFOCUS Security Team (CVE-2018-16022, CVE-2018-16021, CVE-2018-16017, CVE-2018-16000, CVE-2018-16006, CVE-2018-15999)
Lin Wang of Beihang University via Trend Micro's Zero Day Initiative (CVE-2018-16014)
guyio via Trend Micro's Zero Day Initiative (CVE-2018-16024, CVE-2018-16023, CVE-2018-15995)
Pengsu Cheng of Trend Micro Security Research via Trend Micro's Zero Day Initiative (CVE-2018-15985)
XuPeng of TCA/SKLCS Institute of Software Chinese Academy of Sciences and HuangZheng of Baidu Security Lab (CVE-2018-12830)
Linan Hao of Qihoo 360 Vulcan Team and Zhenjie Jia of Qihoo 360 Vulcan Team (CVE-2018-16041)
Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-16008)
Roderick Schaefer via Trend Micro Zero Day Initiative (CVE-2018-19713)
Lin Wang of Beihang University (CVE-2018-15998, CVE-2018-15989, CVE-2018-15987, CVE-2018-15986, CVE-2018-15984)
Vladislav Mladenov, Christian Mainka, Karsten Meyer zu Selhausen, Martin Grothe, Jorg Schwenk of the Ruhr-Universität Bochum (CVE-2018-16042)
Aleksandar Nikolic of Cisco Talos (CVE-2018-19716)
Kamlapati Choubey via Trend Micro's Zero Day Initiative (CVE-2018-19714)
Sebastian Apelt (@bitshifter123) via Trend Micro's Zero Day Initiative (CVE-2018-16010, CVE-2018-16003, CVE-2018-16044, CVE-2018-19720, CVE-2018-19719)
AbdulAziz Hariri of the Zero Day Initiative and Sebastian Apelt for defense-in-depth contributions to mitigate the Onix Indexing attack surface (CVE-2018-16004, CVE-2018-16005, CVE-2018-16007, CVE-2018-16009, CVE-2018-16043, CVE-2018-16045, CVE-2018-16046)
Qi Deng of Palo Alto Networks (CVE-2018-16033, CVE-2018-16032, CVE-2018-16031)
Zhibin Zhang of Palo Alto Networks (CVE-2018-16037, CVE-2018-16036, CVE-2018-16034)
Hui Gao and Qi Deng of Palo Alto Networks (CVE-2018-19698, CVE-2018-16047, CVE-2018-16040, CVE-2018-16038)
Hui Gao and Zhibin Zhang of Palo Alto Networks (CVE-2018-19710, CVE-2018-19709, CVE-2018-19707, CVE-2018-19700, CVE-2018-19699)
Bo Qu of Palo Alto Networks and Heige of Knownsec 404 Security Team (CVE-2018-19717, CVE-2018-19715, CVE-2018-19708, CVE-2018-19701, CVE-2018-16039)
Revisions
January 18, 2018: Reference added for CVE-2018-19728
December 18, 2018: Reference removed for CVE-2018-16011
December 18, 2018: Reference removed for CVE-2018-16018