Adobe Security Bulletin

Release date: December 9, 2014

Vulnerability identifier: APSB14-28

Priority: See table below

CVE Numbers: CVE-2014-9165, CVE-2014-8445, CVE-2014-9150, CVE-2014-8446, CVE-2014-8447, CVE-2014-8448, CVE-2014-8449, CVE-2014-8451, CVE-2014-8452, CVE-2014-8453, CVE-2014-8454, CVE-2014-8455, CVE-2014-8456, CVE-2014-8457, CVE-2014-8458, CVE-2014-8459, CVE-2014-8460, CVE-2014-8461, CVE-2014-9158, CVE-2014-9159

Platforms: Windows and Macintosh

Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system.  Adobe recommends users update their product installations to the latest versions:

• Users of Adobe Reader XI (11.0.09) and earlier versions should update to version 11.0.10.
• Users of Adobe Reader X (10.1.12) and earlier versions should update to version 10.1.13.
• Users of Adobe Acrobat XI (11.0.09) and earlier versions should update to version 11.0.10.
• Users of Adobe Acrobat X (10.1.12) and earlier versions should update to version 10.1.13.

• Adobe Reader XI (11.0.09) and earlier versions
• Adobe Reader X (10.1.12) and earlier versions
• Adobe Acrobat XI (11.0.09) and earlier versions
• Adobe Acrobat X (10.1.12) and earlier versions

Adobe recommends users update their software installations by following the instructions below:

Adobe Reader

The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.

Adobe Reader users on Windows can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows

Adobe Reader users on Macintosh can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Macintosh

Adobe Acrobat

The product's default update mechanism is set to run automatic update checks on a regular schedule. Update checks can be manually activated by choosing Help > Check for Updates.

Acrobat Standard and Pro users on Windows can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows

Acrobat Pro users on Macintosh can find the appropriate update here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

Adobe categorizes these updates with the following priority ratings and recommends users update their installations to the newest versions:

These updates address critical vulnerabilities in the software.

Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system.  Adobe recommends users update their product installations to the latest versions:

• Users of Adobe Reader XI (11.0.09) and earlier versions should update to version 11.0.10.
• Users of Adobe Reader X (10.1.12) and earlier versions should update to version 10.1.13.
• Users of Adobe Acrobat XI (11.0.09) and earlier versions should update to version 11.0.10.
• Users of Adobe Acrobat X (10.1.12) and earlier versions should update to version 10.1.13.

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2014-8454, CVE-2014-8455, CVE-2014-9165).

These updates resolve heap-based buffer overflow vulnerabilities that could lead to code execution (CVE-2014-8457, CVE-2014-8460, CVE-2014-9159).

These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2014-8449).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2014-8445, CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8458, CVE-2014-8459, CVE-2014-8461, CVE-2014-9158).

These updates resolve a time-of-check time-of-use (TOCTOU) race condition that could be exploited to allow arbitrary write access to the file system (CVE-2014-9150).

These updates resolve an improper implementation of a Javascript API that could lead to information disclosure (CVE-2014-8448, CVE-2014-8451).

These updates resolve a vulnerability in the handling of XML external entities that could lead to information disclosure (CVE-2014-8452).

These updates resolve vulnerabilities that could be exploited to circumvent the same-origin policy (CVE-2014-8453).  

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

• Alex Inführ of Cure53.de (CVE-2014-8451, CVE-2014-8452, CVE-2014-8453)
• Ashfaq Ansari of Payatu Technologies (CVE-2014-8446)
• Corbin Souffrant, Armin Buescher and Dan Caselden of FireEye (CVE-2014-8454)
• Jack Tang of Trend Micro (CVE-2014-8447)
• James Forshaw of Google Project Zero (CVE-2014-9150)
• lokihardt@asrt (CVE-2014-8448)
• Mateusz Jurczyk of Google Project Zero and Gynvael Coldwind of Google Security Team (CVE-2014-8455, CVE-2014-8456, CVE-2014-8457, CVE-2014-8458, CVE-2014-8459, CVE-2014-8460, CVE-2014-8461, CVE-2014-9158, CVE-2014-9159)
• Pedro Ribeiro of Agile Information Security (CVE-2014-8449)
• Wei Lei and Wu Hongjun of Nanyang Technological University (CVE-2014-8445, CVE-2014-9165)