vulnerability note CVE-2010-0186 CVE-2010-0188

Adobe Acrobat/Reader: two vulnerabilities

Synthesis of the vulnerability

An attacker can use two Adobe Acrobat/Reader vulnerabilities, in order to access to a domain, or to execute code.

Severity: 3/4. Creation date: 17/02/2010. Revision date: 15/03/2010.

Description of the vulnerability

Two vulnerabilities were announced in Adobe Acrobat/Reader. A Flash application, which can be included in a pdf document, can query a domain different from its origin domain. [severity:3/4; BID-38198, CVE-2010-0186, >] A malicious PDF document can corrupt the memory, in order to generate a denial of service, and possibly to execute code. [severity:3/4; CVE-2010-0188, >] An attacker can therefore use two Adobe Acrobat/Reader vulnerabilities, in order to access to a domain, or to execute code.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: Adobe Acrobat/Reader: two vulnerabilities. Keywords: Acrobat Adobe Flash PDF Reader vulnerabilities. Identifiers: APSB10-07, BID-38195, BID-38198, CVE-2010-0186, CVE-2010-0188, RHSA-2010:0114-01, SUSE-SR:2010:006, VIGILANCE-VUL-9454.

Information sources

Publications and announces Source example: Security updates available for Adobe Reader and Acrobat

Solutions for this vulnerability

Patch or workaround

Supplements

Vulnerability : CVE-2010-0186 A Flash application, which can be included in a pdf document, can query a domain different from its origin domain. Severity: 3/4. Identifiers: BID-38198, CVE-2010-0186. Publications and announces Source example: Neat, New, and Ridiculous Flash Hacks

Vulnerability : CVE-2010-0188 A malicious PDF document can corrupt the memory, in order to generate a denial of service, and possibly to execute code. Severity: 3/4. Identifiers: CVE-2010-0188.

Attack Exploit 0day or proof of concept

Metasploit attack Exploit 0day or proof of concept

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Computer vulnerability bulletins