PT-2014-1401 · Adobe · Reader+1

Published 2014-05-13 · Updated 2014-05-14 · CVE-2014-0521

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Reader and Acrobat versions 10.x through 10.1.9 Adobe Reader and Acrobat versions 11.x through 11.0.06

Description The issue arises from the improper implementation of JavaScript APIs in Adobe Reader and Acrobat, allowing remote attackers to obtain sensitive information via a crafted PDF document. This can be exploited by attackers to gain access to confidential information.

Recommendations For Adobe Reader and Acrobat versions 10.x through 10.1.9, update to version 10.1.10 or later. For Adobe Reader and Acrobat versions 11.x through 11.0.06, update to version 11.0.07 or later. As a temporary workaround, consider disabling JavaScript APIs in Adobe Reader and Acrobat until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-00347

BDU:2015-00348

CVE-2014-0521

Affected Products

Acrobat

Reader

References · 8

• 🔥 https://github.com/molnarg/cve-2014-0521 · Exploit
• https://bdu.fstec.ru/vul/2015-00347 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0521 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0521 · Security Note
• https://bdu.fstec.ru/vul/2015-00348 · Security Note
• http://helpx.adobe.com/security/products/reader/apsb14-15.html · Vendor Advisory
• apsb14-15: · Note
• http://helpx.adobe.com/security/products/acrobat/apsb14-15.html · Note