CVSS: 9.3EPSS: 37%CPEs: 59EXPL: 0CVE-2011-0590 – Adobe Acrobat Reader U3D Texture Parser ILBM Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0590
Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a 3D file, a different vulnerability than CVE-2011-0591, CVE-2011-0592, CVE-2011-0593, CVE-2011-0595, and CVE-2011-0600. Adobe Reader y Acrobat v10.x anterior a v10.0.1, v9.x anterior a v9.4.2, y v8.x anterior a v8.2.6 en Windows y Mac OS X permite a atacantes remotos ejecutar código de su elección a través de un archivo 3D, una vulnerabilidad diferente de CVE-2011-0591, CVE-2011-0592, CVE-2011-0593, CVE-2011-0595 y CVE-2011-0600. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the application's implementation of an image format supported by the Universal 3D compressed file format. When parsing a particular texture file specified by the format, the application will explicitly trust fields within the file in a multiply used to allocate space for the image data. • http://secunia.com/advisories/43470 http://www.adobe.com/support/security/bulletins/apsb11-03.html http://www.redhat.com/support/errata/RHSA-2011-0301.html http://www.securitytracker.com/id?1025033 http://www.vupen.com/english/advisories/2011/0337 http://www.vupen.com/english/advisories/2011/0492 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12621 https://access.redhat.com/security/cve/CVE-2011-0590 https://bugzilla.redhat.com/show_bug.cgi • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 27%CPEs: 59EXPL: 0CVE-2011-0591 – Adobe Acrobat Reader U3D Texture rgba RLE Decompression Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0591
Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code via a crafted Universal 3D (U3D) file that triggers a buffer overflow during decompression, related to Texture and rgba, a different vulnerability than CVE-2011-0590, CVE-2011-0592, CVE-2011-0593, CVE-2011-0595, and CVE-2011-0600. Adobe Reader y Acrobat v10.x anterior a v10.0.1, v9.x anterior a v9.4.2, y v8.x anterior a v8.2.6 en Windows y Mac OS X permite a atacantes remotos ejecutar código de su elección a través de un archivo 3D, una vulnerabilidad diferente de CVE-2011-0590, CVE-2011-0592, CVE-2011-0593, CVE-2011-0595, y CVE-2011-0600. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the application's implementation of an image format supported by the Universal 3D compressed file format. When decoding the image data provided by the file, the application will one size for allocating space for the destination buffer and then trust the data when decompressing into that buffer. • http://secunia.com/advisories/43470 http://www.adobe.com/support/security/bulletins/apsb11-03.html http://www.redhat.com/support/errata/RHSA-2011-0301.html http://www.securityfocus.com/bid/46209 http://www.securitytracker.com/id?1025033 http://www.vupen.com/english/advisories/2011/0337 http://www.vupen.com/english/advisories/2011/0492 http://www.zerodayinitiative.com/advisories/ZDI-11-067 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12558 htt • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 84%CPEs: 57EXPL: 3CVE-2010-4091 – Acrobat Reader 9.4 - Memory Corruption
https://notcve.org/view.php?id=CVE-2010-4091
The EScript.api plugin in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.1, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document that triggers memory corruption, involving the printSeps function. NOTE: some of these details are obtained from third party information. El plugin EScript.api en Adobe Reader y Acrobat versión 10.x anterior a 10.0.1, versión 9.x anterior a 9.4.1 y versión 8.x anterior a 8.2.6 en Windows y Mac OS X, permite a los atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (bloqueo de aplicación) por medio de un documento PDF creado que desencadena una corrupción de memoria, que involucran a la función printSeps. NOTA: algunos de estos datos se consiguen de la información de terceros. • https://www.exploit-db.com/exploits/15419 http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0024.html http://blogs.adobe.com/psirt/2010/11/potential-issue-in-adobe-reader.html http://extraexploit.blogspot.com/2010/11/full-disclosure-xplpdf-adober-reader-94.html http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00001.html http://osvdb.org/69005 http://secunia.com/advisories/42095 http://secunia.com/advisories/42401 http://secunia.com/advisories/43025 http:/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •