cvelistv5 - cve-2011-2462

CVE-2011-2462 (GCVE-0-2011-2462)

Vulnerability from cvelistv5

Published

2011-12-07 19:00

Modified

2025-11-21 15:56

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html	vendor-advisory, x_refsource_SUSE
	http://www.adobe.com/support/security/bulletins/apsb12-01.html	x_refsource_CONFIRM
	http://www.adobe.com/support/security/advisories/apsa11-04.html	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2012-0011.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html	vendor-advisory, x_refsource_SUSE
	http://www.adobe.com/support/security/bulletins/apsb11-30.html	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562	vdb-entry, signature, x_refsource_OVAL
	http://www.us-cert.gov/cas/techalerts/TA11-350A.html	third-party-advisory, x_refsource_CERT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2022-06-08

Due date: 2022-06-22

Required action: Apply updates per vendor instructions.

Used in ransomware: Unknown

Notes: https://nvd.nist.gov/vuln/detail/CVE-2011-2462

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:00:33.994Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2012:0087",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.adobe.com/support/security/bulletins/apsb12-01.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.adobe.com/support/security/advisories/apsa11-04.html"
          },
          {
            "name": "RHSA-2012:0011",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2012-0011.html"
          },
          {
            "name": "SUSE-SU-2012:0086",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.adobe.com/support/security/bulletins/apsb11-30.html"
          },
          {
            "name": "oval:org.mitre.oval:def:14562",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562"
          },
          {
            "name": "TA11-350A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA11-350A.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2011-2462",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-21T15:55:34.571121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-06-08",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2462"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-21T15:56:38.224Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2462"
          },
          {
            "tags": [
              "issue-tracking"
            ],
            "url": "https://github.com/cisagov/vulnrichment/issues/199"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-12-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "name": "openSUSE-SU-2012:0087",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.adobe.com/support/security/bulletins/apsb12-01.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.adobe.com/support/security/advisories/apsa11-04.html"
        },
        {
          "name": "RHSA-2012:0011",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2012-0011.html"
        },
        {
          "name": "SUSE-SU-2012:0086",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.adobe.com/support/security/bulletins/apsb11-30.html"
        },
        {
          "name": "oval:org.mitre.oval:def:14562",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562"
        },
        {
          "name": "TA11-350A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA11-350A.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2011-2462",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2012:0087",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html"
            },
            {
              "name": "http://www.adobe.com/support/security/bulletins/apsb12-01.html",
              "refsource": "CONFIRM",
              "url": "http://www.adobe.com/support/security/bulletins/apsb12-01.html"
            },
            {
              "name": "http://www.adobe.com/support/security/advisories/apsa11-04.html",
              "refsource": "CONFIRM",
              "url": "http://www.adobe.com/support/security/advisories/apsa11-04.html"
            },
            {
              "name": "RHSA-2012:0011",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2012-0011.html"
            },
            {
              "name": "SUSE-SU-2012:0086",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html"
            },
            {
              "name": "http://www.adobe.com/support/security/bulletins/apsb11-30.html",
              "refsource": "CONFIRM",
              "url": "http://www.adobe.com/support/security/bulletins/apsb11-30.html"
            },
            {
              "name": "oval:org.mitre.oval:def:14562",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562"
            },
            {
              "name": "TA11-350A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA11-350A.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2011-2462",
    "datePublished": "2011-12-07T19:00:00.000Z",
    "dateReserved": "2011-06-06T00:00:00.000Z",
    "dateUpdated": "2025-11-21T15:56:38.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2011-2462",
      "cwes": "[\"CWE-787\"]",
      "dateAdded": "2022-06-08",
      "dueDate": "2022-06-22",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2011-2462",
      "product": "Reader and Acrobat",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS).",
      "vendorProject": "Adobe",
      "vulnerabilityName": "Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html\", \"name\": \"openSUSE-SU-2012:0087\", \"tags\": [\"vendor-advisory\", \"x_refsource_SUSE\", \"x_transferred\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb12-01.html\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"http://www.adobe.com/support/security/advisories/apsa11-04.html\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2012-0011.html\", \"name\": \"RHSA-2012:0011\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\", \"x_transferred\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html\", \"name\": \"SUSE-SU-2012:0086\", \"tags\": [\"vendor-advisory\", \"x_refsource_SUSE\", \"x_transferred\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb11-30.html\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562\", \"name\": \"oval:org.mitre.oval:def:14562\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\", \"x_transferred\"]}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA11-350A.html\", \"name\": \"TA11-350A\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-06T23:00:33.994Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2011-2462\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-21T15:55:34.571121Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2022-06-08\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2462\"}}}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2462\", \"tags\": [\"government-resource\"]}, {\"url\": \"https://github.com/cisagov/vulnrichment/issues/199\", \"tags\": [\"issue-tracking\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T21:47:35.982Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2011-12-06T00:00:00.000Z\", \"references\": [{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html\", \"name\": \"openSUSE-SU-2012:0087\", \"tags\": [\"vendor-advisory\", \"x_refsource_SUSE\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb12-01.html\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"http://www.adobe.com/support/security/advisories/apsa11-04.html\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2012-0011.html\", \"name\": \"RHSA-2012:0011\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html\", \"name\": \"SUSE-SU-2012:0086\", \"tags\": [\"vendor-advisory\", \"x_refsource_SUSE\"]}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb11-30.html\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562\", \"name\": \"oval:org.mitre.oval:def:14562\", \"tags\": [\"vdb-entry\", \"signature\", \"x_refsource_OVAL\"]}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA11-350A.html\", \"name\": \"TA11-350A\", \"tags\": [\"third-party-advisory\", \"x_refsource_CERT\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"shortName\": \"adobe\", \"dateUpdated\": \"2017-09-18T12:57:01.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"n/a\"}]}, \"product_name\": \"n/a\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html\", \"name\": \"openSUSE-SU-2012:0087\", \"refsource\": \"SUSE\"}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb12-01.html\", \"name\": \"http://www.adobe.com/support/security/bulletins/apsb12-01.html\", \"refsource\": \"CONFIRM\"}, {\"url\": \"http://www.adobe.com/support/security/advisories/apsa11-04.html\", \"name\": \"http://www.adobe.com/support/security/advisories/apsa11-04.html\", \"refsource\": \"CONFIRM\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2012-0011.html\", \"name\": \"RHSA-2012:0011\", \"refsource\": \"REDHAT\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html\", \"name\": \"SUSE-SU-2012:0086\", \"refsource\": \"SUSE\"}, {\"url\": \"http://www.adobe.com/support/security/bulletins/apsb11-30.html\", \"name\": \"http://www.adobe.com/support/security/bulletins/apsb11-30.html\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14562\", \"name\": \"oval:org.mitre.oval:def:14562\", \"refsource\": \"OVAL\"}, {\"url\": \"http://www.us-cert.gov/cas/techalerts/TA11-350A.html\", \"name\": \"TA11-350A\", \"refsource\": \"CERT\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"n/a\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2011-2462\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"psirt@adobe.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2011-2462\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-21T15:56:38.224Z\", \"dateReserved\": \"2011-06-06T00:00:00.000Z\", \"assignerOrgId\": \"078d4453-3bcd-4900-85e6-15281da43538\", \"datePublished\": \"2011-12-07T19:00:00.000Z\", \"assignerShortName\": \"adobe\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTA-2011-ALE-008

Vulnerability from certfr_alerte

Une vulnérabilité permettant l'exécution de code arbitraire à distance affecte les produits Adobe Acrobat et Adobe Reader. Celle-ci est actuellement exploitée.

Un correctif est publié pour la version 9 des deux produits.

Description

Les logiciels Adobe Acrobat et Adobe Reader sont vulnérables à une faille permettant à une personne malintentionnée d'exécuter du code arbitraire à distance. Elle est actuellement exploitée sur l'Internet au moyen de document PDF spécialement conçus.

Contournement provisoire

Il est possible, dans les versions 10.n (ou X.n) de ces produits, d'activer des modes de protection (Protected Mode pour Adobe Reader et Protected View pour Adobe Acrobat ) pour rendre plus difficile l'exploitation de cette vulnérabilité. Adobe annonce qu'un correctif pour ces versions sera publié le 10 janvier 2012.

Le CERTA recommande l'utilisation d'un logiciel alternatif tant qu'un correctif n'est pas disponible.

Mise à jour du 19 décembre 2011 : la version 9.4.7 de chacun des deux produits corrige le problème. Mise à jour du 10 janvier 2012 : les versions 9.5 et 10.1.2 de chacun des deux produits corrigent le problème.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Adobe	Acrobat	Adobe Acrobat 9.4.6 et versions 9.x antérieures pour systèmes Windows et Macintosh.
Adobe	Acrobat	Adobe Acrobat X (10.1.1) et versions 10.x antérieures pour systèmes Windows et Macintosh ;
Adobe	Acrobat	Adobe Reader 9.4.6 et versions 9.x antérieures pour systèmes Windows, Macintosh et UNIX ;
Adobe	Acrobat	Adobe Reader X (10.1.1) et versions 10.x antérieures pour systèmes Windows et Macintosh ;

References

Title

Publication Time

Tags

Alerte de sécurité Adobe APSA11-04 du 16 décembre 2011	None	vendor-advisory
Avis du CERTA CERTA-2011-AVI-705 du 19 décembre 2011 :	-	other
Avis du CERTA CERTA-2012-AVI-014 du 10 janvier 2012 :	-	other
Bulletin de sécurité Adobe APSB12-01 du 10 janvier 2012 :	-	other
Bulletin de sécurité Adobe APSB11-30 du 16 décembre 2011 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Acrobat 9.4.6 et versions 9.x ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh.",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat X (10.1.1) et versions 10.x ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader 9.4.6 et versions 9.x ant\u00e9rieures pour syst\u00e8mes Windows, Macintosh et UNIX ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader X (10.1.1) et versions 10.x ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2012-01-10",
  "content": "## Description\n\nLes logiciels Adobe Acrobat et Adobe Reader sont vuln\u00e9rables \u00e0 une\nfaille permettant \u00e0 une personne malintentionn\u00e9e d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance. Elle est actuellement exploit\u00e9e sur l\u0027Internet au\nmoyen de document PDF sp\u00e9cialement con\u00e7us.\n\n## Contournement provisoire\n\nIl est possible, dans les versions 10.n (ou X.n) de ces produits,\nd\u0027activer des modes de protection (Protected Mode pour Adobe Reader et\nProtected View pour Adobe Acrobat ) pour rendre plus difficile\nl\u0027exploitation de cette vuln\u00e9rabilit\u00e9. Adobe annonce qu\u0027un correctif\npour ces versions sera publi\u00e9 le 10 janvier 2012.\n\nLe CERTA recommande l\u0027utilisation d\u0027un logiciel alternatif tant qu\u0027un\ncorrectif n\u0027est pas disponible.\n\n  \n  \n\nMise \u00e0 jour du 19 d\u00e9cembre 2011\u00a0: la version 9.4.7 de chacun des deux\nproduits corrige le probl\u00e8me. Mise \u00e0 jour du 10 janvier 2012\u00a0: les\nversions 9.5 et 10.1.2 de chacun des deux produits corrigent le\nprobl\u00e8me.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-2462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2462"
    }
  ],
  "initial_release_date": "2011-12-07T00:00:00",
  "last_revision_date": "2012-01-10T00:00:00",
  "links": [
    {
      "title": "Avis du CERTA CERTA-2011-AVI-705 du 19 d\u00e9cembre 2011 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2011-AVI-705/index.html"
    },
    {
      "title": "Avis du CERTA CERTA-2012-AVI-014 du 10 janvier 2012 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2012-AVI-014/index.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB12-01 du 10 janvier 2012 :",
      "url": "http://www.adobe.com/support/security/bulletins/apsb12-01.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB11-30 du 16 d\u00e9cembre 2011 :",
      "url": "http://www.adobe.com/support/security/bulletins/apsb11-30.html"
    }
  ],
  "reference": "CERTA-2011-ALE-008",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-12-07T00:00:00.000000"
    },
    {
      "description": "publication d\u0027un correctif pour les versions 9.",
      "revision_date": "2011-12-19T00:00:00.000000"
    },
    {
      "description": "publication d\u0027un correctif pour les versions 10.",
      "revision_date": "2012-01-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 permettant l\u0027ex\u00e9cution de code arbitraire \u00e0 distance\naffecte les produits Adobe Acrobat et Adobe Reader. Celle-ci est\nactuellement exploit\u00e9e.\n\nUn correctif est publi\u00e9 pour la version 9 des deux produits.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Adobe Reader et Acrobat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Alerte de s\u00e9curit\u00e9 Adobe APSA11-04 du 16 d\u00e9cembre 2011",
      "url": "http://www.adobe.com/support/security/advisories/apsa11-04.html"
    }
  ]
}

CERTA-2011-AVI-705

Vulnerability from certfr_avis

Des vulnérabilités dans Adobe Acrobat et Adobe Reader permettent à un utilisateur malveillant l'exécution de code arbitraire à distance.

Description

Des vulnérabilités affectent les composants en relation avec les fonctions de 3D des lecteurs PDF Adobe Reader et Acrobat Reader. Un attaquant peut les exploiter pour exécuter du code arbitraire sur le système d'un utilisateur qui ouvrirait un fichier au format PDF spécialement construit.

Solution

La version 9.4.7 de chacun des logiciels Adobe Acrobat et Adobe Reader corrige le problème.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Adobe	Acrobat Reader	Adobe Acrobat 9.4.6 et versions 9.x antérieures pour systèmes Windows et Macintosh.
Adobe	Acrobat Reader	Adobe Reader 9.4.6 et versions 9.x antérieures pour systèmes Windows, Macintosh et UNIX ;
Adobe	Acrobat Reader	Adobe Acrobat X (10.1.1) et versions 10.x antérieures pour systèmes Windows et Macintosh ;
Adobe	Acrobat Reader	Adobe Reader X (10.1.1) et versions 10.x antérieures pour systèmes Windows et Macintosh ;

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe apsb11-30 du 16 décembre 2011	None	vendor-advisory
Bulletin d'alerte Adobe apsa11-04 du 16 décembre 2011 :	-	other
Document du CERTA CERTA-2011-ALE-008 du 19 décembre 2011 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Acrobat 9.4.6 et versions 9.x ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh.",
      "product": {
        "name": "Acrobat Reader",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader 9.4.6 et versions 9.x ant\u00e9rieures pour syst\u00e8mes Windows, Macintosh et UNIX ;",
      "product": {
        "name": "Acrobat Reader",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat X (10.1.1) et versions 10.x ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh ;",
      "product": {
        "name": "Acrobat Reader",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader X (10.1.1) et versions 10.x ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh ;",
      "product": {
        "name": "Acrobat Reader",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDes vuln\u00e9rabilit\u00e9s affectent les composants en relation avec les\nfonctions de 3D des lecteurs PDF Adobe Reader et Acrobat Reader. Un\nattaquant peut les exploiter pour ex\u00e9cuter du code arbitraire sur le\nsyst\u00e8me d\u0027un utilisateur qui ouvrirait un fichier au format PDF\nsp\u00e9cialement construit.\n\n## Solution\n\nLa version 9.4.7 de chacun des logiciels Adobe Acrobat et Adobe Reader\ncorrige le probl\u00e8me.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-2462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2462"
    },
    {
      "name": "CVE-2011-4369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4369"
    }
  ],
  "initial_release_date": "2011-12-19T00:00:00",
  "last_revision_date": "2011-12-19T00:00:00",
  "links": [
    {
      "title": "Bulletin d\u0027alerte Adobe apsa11-04 du 16 d\u00e9cembre 2011 :",
      "url": "http://www.adobe.com/support/security/advisories/apsa11-04.html"
    },
    {
      "title": "Document du CERTA CERTA-2011-ALE-008 du 19 d\u00e9cembre 2011 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2011-ALE-008/index.html"
    }
  ],
  "reference": "CERTA-2011-AVI-705",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-12-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Des vuln\u00e9rabilit\u00e9s dans Adobe Acrobat et Adobe Reader permettent \u00e0 un\nutilisateur malveillant l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Adobe Reader et Acrobat Reader",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe apsb11-30 du 16 d\u00e9cembre 2011",
      "url": "http://www.adobe.com/support/security/bulletins/apsb11-30.html"
    }
  ]
}

CERTA-2012-AVI-014

Vulnerability from certfr_avis

Plusieurs vulnérabilités dans Adobe Reader et Adobe Acrobat permettent l'exécution de code arbitraire à distance.

Description

Plusieurs vulnérabilités affectent les composants en relation avec les fonctions 3D des logiciels Adobe Reader et Adobe Acrobat. Un attaquant peut exécuter du code arbitraire à distance sur le système de la victime par le biais d'un fichier spécialement conçu qui serait ouvert en utilisant un de ces logiciels.

Solution

Les versions 9.5 et 10.1.2 de ces logiciels corrigent le problème.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Adobe	Acrobat	Adobe Reader 9.4.6 et antérieures pour systèmes Macintosh ;
Adobe	Acrobat	Adobe Reader X (10.1.1) et antérieures pour systèmes Windows et Macintosh ;
Adobe	Acrobat	Adobe Acrobat 9.4.7 et antérieures pour systèmes Windows ;
Adobe	Acrobat	Adobe Reader 9.4.7 et antérieures pour systèmes Windows ;
Adobe	Acrobat	Adobe Acrobat X (10.1.1) et antérieures pour systèmes Windows et Macintosh ;
Adobe	Acrobat	Adobe Acrobat 9.4.6 et antérieures pour systèmes Macintosh.

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe APSB12-01 du 10 janvier 2012

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Reader 9.4.6 et ant\u00e9rieures pour syst\u00e8mes Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader X (10.1.1) et ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat 9.4.7 et ant\u00e9rieures pour syst\u00e8mes Windows ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Reader 9.4.7 et ant\u00e9rieures pour syst\u00e8mes Windows ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat X (10.1.1) et ant\u00e9rieures pour syst\u00e8mes Windows et Macintosh ;",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Acrobat 9.4.6 et ant\u00e9rieures pour syst\u00e8mes Macintosh.",
      "product": {
        "name": "Acrobat",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s affectent les composants en relation avec les\nfonctions 3D des logiciels Adobe Reader et Adobe Acrobat. Un attaquant\npeut ex\u00e9cuter du code arbitraire \u00e0 distance sur le syst\u00e8me de la victime\npar le biais d\u0027un fichier sp\u00e9cialement con\u00e7u qui serait ouvert en\nutilisant un de ces logiciels.\n\n## Solution\n\nLes versions 9.5 et 10.1.2 de ces logiciels corrigent le probl\u00e8me.\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-4372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4372"
    },
    {
      "name": "CVE-2011-4373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4373"
    },
    {
      "name": "CVE-2011-4371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4371"
    },
    {
      "name": "CVE-2011-2462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-2462"
    },
    {
      "name": "CVE-2011-4369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4369"
    },
    {
      "name": "CVE-2011-4370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4370"
    }
  ],
  "initial_release_date": "2012-01-11T00:00:00",
  "last_revision_date": "2012-01-11T00:00:00",
  "links": [],
  "reference": "CERTA-2012-AVI-014",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2012-01-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s dans Adobe Reader et Adobe Acrobat permettent\nl\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Adobe Reader et Adobe Acrobat",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe APSB12-01 du 10 janvier 2012",
      "url": "http://www.adobe.com/support/security/bulletins/apsb12-01.html"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2011-2462 (GCVE-0-2011-2462)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

CERTA-2011-ALE-008

Vulnerability from certfr_alerte

Description

Contournement provisoire

Solution

CERTA-2011-AVI-705

Vulnerability from certfr_avis

Description

Solution

CERTA-2012-AVI-014

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature