Adobe Security Bulletin

Release date: September 16, 2014

Vulnerability identifier: APSB14-20

Priority: See table below

CVE Numbers: CVE-2014-0560, CVE-2014-0561, CVE-2014-0562, CVE-2014-0563, CVE-2014-0565, CVE-2014-0566, CVE-2014-0567, CVE-2014-0568

Platform: Windows and Macintosh

Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system.  Adobe recommends users update their product installations to the latest versions:

• Users of Adobe Reader XI (11.0.08) and earlier versions should update to version 11.0.09.
• For users of Adobe Reader X (10.1.11) and earlier versions who cannot update to version 11.0.09, Adobe has made available version 10.1.12.
• Users of Adobe Acrobat XI (11.0.08) and earlier versions should update to version 11.0.09.
• For users of Adobe Acrobat X (10.1.11) and earlier versions, who cannot update to version 11.0.09, Adobe has made available version 10.1.12.

• Adobe Reader XI (11.0.08) and earlier 11.x versions for Windows 
• Adobe Reader XI (11.0.07) and earlier 11.x versions for Macintosh
  

• Adobe Reader X (10.1.11) and earlier 10.x versions for Windows
• Adobe Reader X (10.1.10) and earlier 10.x versions for Macintosh

• Adobe Acrobat XI (11.0.08) and earlier 11.x versions for Windows
• Adobe Acrobat XI (11.0.07) and earlier 11.x versions for Macintosh
  

• Adobe Acrobat X (10.1.11) and earlier 10.x versions for Windows
• Adobe Acrobat X (10.1.10) and earlier 10.x versions for Macintosh
  

Adobe recommends users update their software installations by following the instructions below:

Adobe Reader

The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.

Adobe Reader users on Windows can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows

Adobe Reader users on Macintosh can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh

Adobe Acrobat

The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.

Acrobat Standard and Pro users on Windows can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Acrobat Pro users on Macintosh can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

Adobe categorizes these updates with the following priority ratings and recommends users update their installations to the newest versions:

These updates address critical vulnerabilities in the software.

Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system. Adobe recommends users update their product installations to the latest versions:

• Users of Adobe Reader XI (11.0.08) and earlier versions should update to version 11.0.09.
• For users of Adobe Reader X (10.1.11) and earlier versions who cannot update to version 11.0.09, Adobe has made available version 10.1.12.
• Users of Adobe Acrobat XI (11.0.08) and earlier versions should update to version 11.0.09.
• For users of Adobe Acrobat X (10.1.11) and earlier versions, who cannot update to version 11.0.09, Adobe has made available version 10.1.12.
  

These updates resolve a use-after-free vulnerability that could lead to code execution (CVE-2014-0560).

These updates resolve a universal cross-site scripting (UXSS) vulnerability in Reader and Acrobat on the Macintosh platform (CVE-2014-0562).

These updates resolve a potential denial-of-service (DoS) vulnerability related to memory corruption (CVE-2014-0563).

These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2014-0561, CVE-2014-0567).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2014-0565, CVE-2014-0566).

These updates resolve a sandbox bypass vulnerability that could be exploited to run native code with escalated privileges on Windows (CVE-2014-0568).

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

• Wei Lei and Wu Hongjun of Nanyang Technological University working with Verisign iDefense Labs (CVE-2014-0560)
• Tom Ferris working with HP's Zero Day Initiative (CVE-2014-0561)

• Frans Rosen of Detectify (CVE-2014-0562)
• Wei Lei and Wu Hongjun of Nanyang Technological University (CVE-2014-0563, CVE-2014-0565, CVE-2014-0566)

• Anonymously reported through HP's Zero Day Initiative (CVE-2014-0567)

• James Forshaw of Google Project Zero (CVE-2014-0568)