Security updates available for Adobe Acrobat and Reader | APSB18-09
Bulletin ID Date Published Priority
APSB18-09 May 14, 2018 1

Summary

Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS. These updates address critical vulnerabilities whose successful exploitation could lead to arbitrary code execution in the context of the current user.

Adobe is aware of a report that an exploit for CVE-2018-4990 exists in the wild.  Additionally, proof-of-concept code for CVE-2018-4993 has been published and is publicly available.  

Affected Versions

Product Track Affected Versions Platform
Acrobat DC  Continuous
2018.011.20038 and earlier versions 
Windows and macOS
Acrobat Reader DC  Continuous
2018.011.20038 and earlier versions 
Windows and macOS
       
Acrobat 2017 Classic 2017 2017.011.30079 and earlier versions Windows and macOS
Acrobat Reader 2017 Classic 2017 2017.011.30079 and earlier versions Windows and macOS
       
Acrobat DC  Classic 2015 2015.006.30417 and earlier versions
Windows and macOS
Acrobat Reader DC  Classic 2015 2015.006.30417 and earlier versions
Windows and macOS

For more information on Acrobat DC, please visit the Acrobat DC FAQ page.

For more information on Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page.

Solution

Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:

  • Users can update their product installations manually by choosing Help > Check for Updates.
  • The products will update automatically, without requiring user intervention, when updates are
    detected.
  • The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.

For IT administrators (managed environments):

  • Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
  • Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM
    (Windows), or on Macintosh, Apple Remote Desktop and SSH.

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product Track Updated Versions Platform Priority Rating Availability
Acrobat DC Continuous 2018.011.20040
Windows and macOS 1 Windows
macOS
Acrobat Reader DC Continuous 2018.011.20040
Windows and macOS 1 Windows
macOS
           
Acrobat 2017 Classic 2017 2017.011.30080 Windows and macOS 1 Windows
macOS
Acrobat Reader DC 2017 Classic 2017 2017.011.30080 Windows and macOS 1 Windows
macOS
           
Acrobat Reader DC (Classic 2015) Classic 2015 2015.006.30418
Windows and macOS
1 Windows
macOS
Acrobat DC (Classic 2015) Classic 2015 2015.006.30418 Windows and macOS 1 Windows
macOS

Note:

As noted in this previous announcement, support for Adobe Acrobat 11.x and Adobe Reader 11.x ended on October 15, 2017.  Version 11.0.23 is the final release for Adobe Acrobat 11.x and Adobe Reader 11.x.  Adobe strongly recommends that you update to the latest versions of Adobe Acrobat DC and Adobe Acrobat Reader DC. By updating installations to the latest versions, you benefit from the latest functional enhancements and improved security measures.

Vulnerability Details

Vulnerability Category Vulnerability Impact Severity CVE Number
Double Free
Arbitrary Code Execution Critical CVE-2018-4990
Heap Overflow
Arbitrary Code Execution
Critical

CVE-2018-4947, CVE-2018-4948, CVE-2018-4966, CVE-2018-4968, CVE-2018-4978, CVE-2018-4982, CVE-2018-4984

Use-after-free 
Arbitrary Code Execution
Critical CVE-2018-4996, CVE-2018-4952, CVE-2018-4954, CVE-2018-4958, CVE-2018-4959, CVE-2018-4961, CVE-2018-4971, CVE-2018-4974, CVE-2018-4977, CVE-2018-4980, CVE-2018-4983, CVE-2018-4988, CVE-2018-4989, CVE-2018-12815
Out-of-bounds write 
Arbitrary Code Execution
Critical CVE-2018-4950 
Security Bypass Information Disclosure Important CVE-2018-4979
Out-of-bounds read Information Disclosure Important CVE-2018-4949, CVE-2018-4951, CVE-2018-4955, CVE-2018-4956, CVE-2018-4957, CVE-2018-4960, CVE-2018-4962, CVE-2018-4963, CVE-2018-4964, CVE-2018-4967, CVE-2018-4969, CVE-2018-4970, CVE-2018-4972, CVE-2018-4973, CVE-2018-4975, CVE-2018-4976, CVE-2018-4981, CVE-2018-4986, CVE-2018-4985
Type Confusion Arbitrary Code Execution Critical CVE-2018-4953, CVE-2018-12812
Untrusted pointer dereference  Arbitrary Code Execution Critical CVE-2018-4987
Memory Corruption Information Disclosure Important CVE-2018-4965
NTLM SSO hash theft Information Disclosure Important CVE-2018-4993
HTTP POST new line injection via XFA submission Security Bypass Important CVE-2018-4995

Note:

Please refer to this KB article for more information on mitigating CVE-2018-4993.  An additional mitigation for CVE-2018-4993 is available to admins that results in blocking PDF actions that open links, including GoToE, GoToR, Launch, Thread, Import Data, Export Form Data, Submit Form, and Reset Form. For more details, refer to this documentation.

Acknowledgements

Adobe would like to thank the following individuals and organizations for reporting the
relevant issues and for working with Adobe to help protect our customers:

  • Aleksandar Nikolic of Cisco Talos (CVE-2018-4996, CVE-2018-4947, CVE-2018-12812, CVE-2018-12815)
  • Anton Cherepanov, ESET and Matt Oh, Microsoft (CVE-2018-4990)
  • Vladislav Stolyarov of Kaspersky Lab (CVE-2018-4988, CVE-2018-4987)
  • Yoav Alon and Netanel Ben-Simon from Check Point Software Technologies (CVE-2018-4985)
  • Gal De Leon of Palo Alto Networks (CVE-2018-4959, CVE-2018-4961)
  • Ke Liu of Tencent's Xuanwu Lab (CVE-2018-4960, CVE-2018-4986)
  • Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-4950, CVE-2018-4951, CVE-2018-4952, CVE-2018-4953, CVE-2018-4954, CVE-2018-4962, CVE-2018-4974)
  • WillJ of Tencent PC Manager via Trend Micro's Zero Day Initiative (CVE-2018-4948, CVE-2018-4949, CVE-2018-4955, CVE-2018-4971, CVE-2018-4973)
  • Riusksk of Tencent Security Platform Department via Trend Micro's Zero Day Initiative (CVE-2018-4956, CVE-2018-4957)
  • Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-4949, CVE-2018-4951, CVE-2018-4960, CVE-2018-4963, CVE-2018-4964, CVE-2018-4965, CVE-2018-4966, CVE-2018-4968, CVE-2018-4969)
  • Ke Liu of Tencent's Xuanwu LAB working via Trend Micro's Zero Day Initiative (CVE-2018-4967, CVE-2018-4970, CVE-2018-4972, CVE-2018-4975, CVE-2018-4976, CVE-2018-4978, CVE-2018-4981, CVE-2018-4982)
  • Sebastian Apelt siberas via Trend Micro's Zero Day Initiative (CVE-2018-4977)
  • AbdulAziz Hariri via Trend Micro's Zero Day Initiative (CVE-2018-4979, CVE-2018-4980, CVE-2018-4984)
  • Hui Gao of Palo Alto Networks and Heige (a.k.a. SuperHei) from Knownsec 404 Security Team (CVE-2018-4958, CVE-2018-4983)
  • Cybellum Technologies LTD (CVE-2018-4989)
  • Alex from Cure53 (CVE-2018-4995)
  • Assaf Baharav, Yaron Fruchtmann and Ido Solomon of Check Point Software Technologies (CVE-2018-4993)

Revisions

May 15, 2018: Added language to notify users that an exploit for CVE-2018-4990 exists in the wild, and that proof-of-concept code for CVE-2018-4985 has been published and is publicly available. Also added CVE-2018-4995 to replace CVE-2018-4994, which was already assigned to an unrelated vulnerability in Adobe Connect. Finally, added CVE-2018-4996 to replace CVE-2018-4946, which was already assigned to an unrelated vulnerability in Adobe Photoshop.

May 16, 2018: Corrected the summary section by replacing CVE-2018-4985 with CVE-2018-4993.  Proof-of-concept code is publicly available for CVE-2018-4993, and not CVE-2018-4985. 

May 17, 2018: Added a link to documentation that describes an additional mitigation for CVE-2018-4993 that will block users from following links in PDF documents.

May 25, 2018: Modified the track name "Consumer" to "Continuous" to align with previous bulletins.