PT-2010-1173 · Adobe · Reader

Jared Allar · Publicado 2010-09-09 · Atualizado 2026-02-23 · CVE-2010-2883

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Reader versions 8.x through 8.2.5 Adobe Reader versions 9.x through 9.3

Description The issue is related to a stack-based buffer overflow in CoolType.dll, allowing remote attackers to execute arbitrary code or cause a denial of service via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font. This issue has been exploited in the wild.

Recommendations For Adobe Reader versions 8.x through 8.2.5, update to version 8.2.5 or later to resolve the issue. For Adobe Reader versions 9.x through 9.3, update to version 9.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of PDF documents with long fields in SING tables in TTF fonts until the issue is resolved.

Exploit

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

BDU:2022-03556

CVE-2010-2883

RHSA-2010:0743

Produtos afetados

Reader

Referências · 32

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_cooltype_sing.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_cooltype_sing.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16619 · Exploit
• 🔥 https://exploit-db.com/exploits/16494 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61635 · Nota
• http://secunia.com/advisories/43025 · Aviso do Fabricante
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• http://adobe.com/support/security/advisories/apsa10-02.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2010/2331 · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA10-279A.html · Nota
• http://kb.cert.org/vuls/id/491991 · Nota
• http://vupen.com/english/advisories/2011/0344 · Aviso do Fabricante
• http://turbolinux.co.jp/security/2011/TLSA-2011-2j.txt · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2010-0743.html · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2883 · Nota