Adobe Security Bulletin

Search

Security Bulletin for Adobe Acrobat and Reader | APSB18-41

Bulletin ID

Date Published

Priority

APSB18-41

December 11, 2018

2

Summary

Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS. These updates address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.   

Affected Versions

Product Track Affected Versions Platform
Acrobat DC  Continuous
 2019.008.20081 and earlier versions 
 Windows 
Acrobat DC  Continuous 2019.008.20080 and earlier versions macOS
Acrobat Reader DC Continuous
 2019.008.20081 and earlier versions Windows
Acrobat Reader DC Continuous 2019.008.20080 and earlier versions macOS
       
Acrobat 2017 Classic 2017 2017.011.30106 and earlier version Windows
Acrobat 2017 Classic 2017 2017.011.30105 and earlier version macOS
Acrobat Reader 2017 Classic 2017 2017.011.30106 and earlier version Windows
Acrobat Reader 2017 Classic 2017 2017.011.30105 and earlier version macOS
       
Acrobat DC  Classic 2015 2015.006.30457 and earlier versions  Windows
Acrobat DC  Classic 2015 2015.006.30456 and earlier versions  macOS
Acrobat Reader DC  Classic 2015 2015.006.30457 and earlier versions  Windows
Acrobat Reader DC Classic 2015 2015.006.30456 and earlier versions  macOS

Solution

Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:

  • Users can update their product installations manually by choosing Help > Check for Updates.
  • The products will update automatically, without requiring user intervention, when updates are detected.
  • The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.

For IT administrators (managed environments):

  • Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
  • Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on macOS, Apple Remote Desktop and SSH.

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product

Track

Updated Versions

Platform

Priority Rating

Availability

Acrobat DC

Continuous

2019.010.20064

Windows and macOS

2

Windows

macOS

Acrobat Reader DC

Continuous

2019.010.20064

Windows and macOS

2

Windows

macOS

 

 

 

 

 

 

Acrobat 2017

Classic 2017

2017.011.30110

Windows and macOS

2

Windows

macOS

Acrobat Reader DC 2017

Classic 2017

2017.011.30110

Windows and macOS

2

Windows

macOS

 

 

 

 

 

 

Acrobat DC

Classic 2015

2015.006.30461

Windows and macOS

2

Windows

macOS

Acrobat Reader DC

Classic 2015

2015.006.30461

Windows and macOS

2

Windows

macOS

Vulnerability Details

Vulnerability Category

Vulnerability Impact

Severity

CVE Number

Buffer Errors

 

Arbitrary Code Execution

 

Critical

 

CVE-2018-15998

CVE-2018-15987

 

Untrusted pointer dereference

 

Arbitrary Code Execution

 

 

 

Critical

 

 

CVE-2018-16004

CVE-2018-19720

Security Bypass

 

Privilege Escalation

 

Critical

 

 

 

CVE-2018-16045

CVE-2018-16044

 

 

Use After Free

 

 

 

 

Arbitrary Code Execution

 

 

 

 

Critical

 

 

CVE-2018-19715

CVE-2018-19713

CVE-2018-19708

CVE-2018-19707

CVE-2018-19700

CVE-2018-19698

CVE-2018-16046

CVE-2018-16040

CVE-2018-16039

CVE-2018-16037

CVE-2018-16036

CVE-2018-16029

CVE-2018-16027

CVE-2018-16026

CVE-2018-16025

CVE-2018-16014

CVE-2018-16008

CVE-2018-16003

CVE-2018-15994

CVE-2018-15993

CVE-2018-15992

CVE-2018-15991

CVE-2018-15990

 

 

Out-of-bounds write 

 

 

 

 

Arbitrary Code Execution

 

 

 

 

Critical

 

 

CVE-2018-19702

CVE-2018-16016

CVE-2018-16000

CVE-2018-15999

CVE-2018-15988

 

 

Heap Overflow

 

 

 

 

Arbitrary Code Execution

 

 

 

 

Critical

 

 

CVE-2018-19716

CVE-2018-16021

CVE-2018-12830

 

 

Out-of-bounds read

 

 

 

 

Information Disclosure

 

 

 

 

Important

 

 

CVE-2018-19717

CVE-2018-19714

CVE-2018-19712

CVE-2018-19711

CVE-2018-19710 

CVE-2018-19709

CVE-2018-19706

CVE-2018-19705

CVE-2018-19704 

CVE-2018-19703

CVE-2018-19701

CVE-2018-19699

CVE-2018-16047 

CVE-2018-16043

CVE-2018-16041

CVE-2018-16038

CVE-2018-16035 

CVE-2018-16034

CVE-2018-16033

CVE-2018-16032

CVE-2018-16031 

CVE-2018-16030

CVE-2018-16028

CVE-2018-16024

CVE-2018-16023 

CVE-2018-16022

CVE-2018-16020

CVE-2018-16019

CVE-2018-16017 

CVE-2018-16015

CVE-2018-16013

CVE-2018-16012

CVE-2018-16010 

CVE-2018-16006

CVE-2018-16005

CVE-2018-16002

CVE-2018-16001 

CVE-2018-15997

CVE-2018-15996

CVE-2018-15989

CVE-2018-15985 

CVE-2018-15984

CVE-2018-19719

CVE-2018-19728

 

Integer Overflow

 

Information Disclosure

 

 

 

Important

 

 

CVE-2018-16009

CVE-2018-16007

CVE-2018-15995

CVE-2018-15986

Security Bypass

Information Disclosure

Important

CVE-2018-16042

Acknowledgements

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

  • Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-16029, CVE-2018-16027, CVE-2018-16025, CVE-2018-15997, CVE-2018-15992)

  • Ke Liu of Tencent's Xuanwu Lab (CVE-2018-19706, CVE-2018-19705, CVE-2018-19704, CVE-2018-19703, CVE-2018-19702, CVE-2018-16035, CVE-2018-16020, CVE-2018-16019, CVE-2018-16016, CVE-2018-16015, CVE-2018-16013, CVE-2018-15990, CVE-2018-15988).

  • kdot working with Trend Micro's Zero Day Initiative (CVE-2018-19712, CVE-2018-19711, CVE-2018-16030, CVE-2018-16028, CVE-2018-16012, CVE-2018-16002, CVE-2018-16001, CVE-2018-15996, CVE-2018-19728)

  • Esteban Ruiz (mr_me) of Source Incite via Trend Micro's Zero Day Initiative (CVE-2018-16026, CVE-2018-15994, CVE-2018-15993, CVE-2018-15991, CVE-2018-16008).

  • Du pingxin From NSFOCUS Security Team (CVE-2018-16022, CVE-2018-16021, CVE-2018-16017, CVE-2018-16000, CVE-2018-16006, CVE-2018-15999)

  • Lin Wang of Beihang University via Trend Micro's Zero Day Initiative (CVE-2018-16014)

  • guyio via Trend Micro's Zero Day Initiative (CVE-2018-16024, CVE-2018-16023, CVE-2018-15995)

  • Pengsu Cheng of Trend Micro Security Research via Trend Micro's Zero Day Initiative (CVE-2018-15985)

  • XuPeng of TCA/SKLCS Institute of Software Chinese Academy of Sciences and HuangZheng of Baidu Security Lab (CVE-2018-12830)

  • Linan Hao of Qihoo 360 Vulcan Team and Zhenjie Jia of Qihoo 360 Vulcan Team (CVE-2018-16041)

  • Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-16008)

  • Roderick Schaefer via Trend Micro Zero Day Initiative (CVE-2018-19713)

  • Lin Wang of Beihang University (CVE-2018-15998, CVE-2018-15989, CVE-2018-15987, CVE-2018-15986, CVE-2018-15984)

  • Vladislav  Mladenov,  Christian  Mainka,  Karsten  Meyer  zu  Selhausen, Martin Grothe, Jorg Schwenk of the Ruhr-Universität Bochum (CVE-2018-16042)

  • Aleksandar Nikolic of Cisco Talos (CVE-2018-19716)

  • Kamlapati Choubey via Trend Micro's Zero Day Initiative (CVE-2018-19714)

  • Sebastian Apelt (@bitshifter123) via Trend Micro's Zero Day Initiative (CVE-2018-16010, CVE-2018-16003, CVE-2018-16044, CVE-2018-19720, CVE-2018-19719)

  • AbdulAziz Hariri of the Zero Day Initiative and Sebastian Apelt for defense-in-depth contributions to mitigate the Onix Indexing attack surface (CVE-2018-16004, CVE-2018-16005, CVE-2018-16007, CVE-2018-16009, CVE-2018-16043, CVE-2018-16045, CVE-2018-16046)

  • Qi Deng of Palo Alto Networks (CVE-2018-16033, CVE-2018-16032, CVE-2018-16031)

  • Zhibin Zhang of Palo Alto Networks (CVE-2018-16037, CVE-2018-16036, CVE-2018-16034)

  • Hui Gao and Qi Deng of Palo Alto Networks (CVE-2018-19698, CVE-2018-16047, CVE-2018-16040, CVE-2018-16038)

  • Hui Gao and Zhibin Zhang of Palo Alto Networks (CVE-2018-19710, CVE-2018-19709, CVE-2018-19707, CVE-2018-19700, CVE-2018-19699)

  • Bo Qu of Palo Alto Networks and Heige of Knownsec 404 Security Team (CVE-2018-19717, CVE-2018-19715, CVE-2018-19708, CVE-2018-19701, CVE-2018-16039)

Revisions

January 18, 2018: Reference added for CVE-2018-19728

December 18, 2018: Reference removed for CVE-2018-16011

December 18, 2018: Reference removed for CVE-2018-16018

Dapatkan bantuan lebih cepat dan lebih mudah

Pengguna baru?

Tautan langsung

Lihat semua paket Anda Kelola paket Anda
Lihat tautan cepat
Sembunyikan tautan cepat