Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS. These updates address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.   

Affected Versions

Solution

Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:

• Users can update their product installations manually by choosing Help > Check for Updates.
• The products will update automatically, without requiring user intervention, when updates are detected.
• The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.
  

For IT administrators (managed environments):

• Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
• Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on macOS, Apple Remote Desktop and SSH.
  

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Vulnerability Details

Acknowledgements

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

• Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-16029, CVE-2018-16027, CVE-2018-16025, CVE-2018-15997, CVE-2018-15992)

• Ke Liu of Tencent's Xuanwu Lab (CVE-2018-19706, CVE-2018-19705, CVE-2018-19704, CVE-2018-19703, CVE-2018-19702, CVE-2018-16035, CVE-2018-16020, CVE-2018-16019, CVE-2018-16016, CVE-2018-16015, CVE-2018-16013, CVE-2018-15990, CVE-2018-15988).

• kdot working with Trend Micro's Zero Day Initiative (CVE-2018-19712, CVE-2018-19711, CVE-2018-16030, CVE-2018-16028, CVE-2018-16012, CVE-2018-16002, CVE-2018-16001, CVE-2018-15996, CVE-2018-19728)

• Esteban Ruiz (mr_me) of Source Incite via Trend Micro's Zero Day Initiative (CVE-2018-16026, CVE-2018-15994, CVE-2018-15993, CVE-2018-15991, CVE-2018-16008).

• Du pingxin From NSFOCUS Security Team (CVE-2018-16022, CVE-2018-16021, CVE-2018-16017, CVE-2018-16000, CVE-2018-16006, CVE-2018-15999)

• Lin Wang of Beihang University via Trend Micro's Zero Day Initiative (CVE-2018-16014)

• guyio via Trend Micro's Zero Day Initiative (CVE-2018-16024, CVE-2018-16023, CVE-2018-15995)

• Pengsu Cheng of Trend Micro Security Research via Trend Micro's Zero Day Initiative (CVE-2018-15985)

• XuPeng of TCA/SKLCS Institute of Software Chinese Academy of Sciences and HuangZheng of Baidu Security Lab (CVE-2018-12830)

• Linan Hao of Qihoo 360 Vulcan Team and Zhenjie Jia of Qihoo 360 Vulcan Team (CVE-2018-16041)

• Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-16008)

• Roderick Schaefer via Trend Micro Zero Day Initiative (CVE-2018-19713)

• Lin Wang of Beihang University (CVE-2018-15998, CVE-2018-15989, CVE-2018-15987, CVE-2018-15986, CVE-2018-15984)

• Vladislav  Mladenov,  Christian  Mainka,  Karsten  Meyer  zu  Selhausen, Martin Grothe, Jorg Schwenk of the Ruhr-Universität Bochum (CVE-2018-16042)

• Aleksandar Nikolic of Cisco Talos (CVE-2018-19716)

• Kamlapati Choubey via Trend Micro's Zero Day Initiative (CVE-2018-19714)

• Sebastian Apelt (@bitshifter123) via Trend Micro's Zero Day Initiative (CVE-2018-16010, CVE-2018-16003, CVE-2018-16044, CVE-2018-19720, CVE-2018-19719)

• AbdulAziz Hariri of the Zero Day Initiative and Sebastian Apelt for defense-in-depth contributions to mitigate the Onix Indexing attack surface (CVE-2018-16004, CVE-2018-16005, CVE-2018-16007, CVE-2018-16009, CVE-2018-16043, CVE-2018-16045, CVE-2018-16046)

• Qi Deng of Palo Alto Networks (CVE-2018-16033, CVE-2018-16032, CVE-2018-16031)

• Zhibin Zhang of Palo Alto Networks (CVE-2018-16037, CVE-2018-16036, CVE-2018-16034)

• Hui Gao and Qi Deng of Palo Alto Networks (CVE-2018-19698, CVE-2018-16047, CVE-2018-16040, CVE-2018-16038)

• Hui Gao and Zhibin Zhang of Palo Alto Networks (CVE-2018-19710, CVE-2018-19709, CVE-2018-19707, CVE-2018-19700, CVE-2018-19699)

• Bo Qu of Palo Alto Networks and Heige of Knownsec 404 Security Team (CVE-2018-19717, CVE-2018-19715, CVE-2018-19708, CVE-2018-19701, CVE-2018-16039)

Revisions

January 18, 2018: Reference added for CVE-2018-19728

December 18, 2018: Reference removed for CVE-2018-16011

December 18, 2018: Reference removed for CVE-2018-16018