CVE-2010-2883 Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denia...
HighCVSS 7.3
EPSS 81.4%
CISA KEV
added 2022-06-08 · due 2022-06-22
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
CISA Known Exploited Vulnerability
- Date added
- 2022-06-08
- Due date (FCEB)
- 2022-06-22
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe acrobat | >= 8.0, < 8.2.5 | 8.2.5 |
| Adobe acrobat | >= 9.0, < 9.4 | 9.4 |
| Adobe Acrobat Reader | >= 8.0, < 8.2.5 | 8.2.5 |
| Adobe Acrobat Reader | >= 9.0, < 9.4 | 9.4 |
References
- blog.metasploit.com broken-link
- community.websense.com broken-link
- SUSE-SA:2010:048 broken-link vendor-advisory
- SUSE-SR:2010:019 broken-link vendor-advisory
- 41340 broken-link third-party-advisory vendor-advisory
- 43025 broken-link third-party-advisory vendor-advisory
- GLSA-201101-08 third-party-advisory vendor-advisory
- www.adobe.com vendor-advisory
- www.adobe.com vendor-advisory
- VU#491991 third-party-advisory us-government-resource
- RHSA-2010:0743 broken-link vendor-advisory
- 43057 broken-link third-party-advisory vdb-entry
- TLSA-2011-2 broken-link vendor-advisory
- TA10-279A third-party-advisory us-government-resource
- ADV-2010-2331 broken-link vdb-entry vendor-advisory
- ADV-2011-0191 broken-link vdb-entry vendor-advisory
- ADV-2011-0344 broken-link vdb-entry vendor-advisory
- adobe-reader-cooltype-code-execution(61635) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:11586 broken-link signature vdb-entry
- www.cisa.gov government-resource us-government-resource