Adobe releases emergency fixes for two critical Acrobat and Reader flaws

The bugs let an attacker execute arbitrary code and allowed privilege escalation via six iterations of the software

Adobe Logo

Adobe has issued emergency patches for a pair of vulnerabilities found in Acrobat and Reader that could have allowed an attacker to infect a user's device with malware and bypass admin privileges.

The developer published a security bulletin yesterday confirming it had detected the two bugs and released fixes, adding they were deemed critical because they could lead to remote code execution and privilege escalation respectively.

The first vulnerability could be exploited by lulling a user into creating a specific PDF file from which code can be executed remotely, which opened the possibility for attackers to run malicious software on a user's machine. The second bug, meanwhile, is a security bypass flaw that could lead to attackers gaining undue administrative access to devices.

They were given a category 2 priority rating, meaning they were deemed very serious but no instances of exploitation had been detected. The critical bugs were found in several iterations of Acrobat, Acrobat DC, and Acrobat Reader on both Windows and macOS.

These including Acrobat DC version and Acrobat Reader DC versions 2019.010.20064 and earlier, Acrobat 2017 and Acrobat Reader 2017 versions 2017.011.30110 and earlier. The bugs were also found on Acrobat DC and Acrobat Reader DC versions on the classic 2015 track, versions 2015.006.30461 and earlier.

Adobe has recommended that users update their software to the latest versions available as soon as possible, or within 30 days according to the developer's categorisation.

The company's widely-used Flash Player was found to suffer from a zero-day vulnerability in February 2018, after the South Korean Computer Emergency Response Team (KR-CERT) issued an alert, warning users of a zero-day vulnerability.

This bug, which Adobe allocated a category 1 priority rating, was said to give attackers the power to persuade users to open Microsft Office documents, web pages, and spam emails.

Featured Resources

How inkjet can transform your business

Get more out of your business by investing in the right printing technology

Download now

Journey to a modern workplace with Office 365: which tools and when?

A guide to how Office 365 builds a modern workplace

Download now

Modernise and transform your sales organisation

Learn how a modernised sales process can drive your business

Download now

Your guide to managing cloud transformation risk

Realise the benefits. Mitigate the risks

Download now

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/cloud/cloud-computing/354767/google-cloud-snaps-up-multi-cloud-analytics-platform-for-26bn
cloud computing

Google Cloud snaps up multi-cloud analytics platform for $2.6bn

13 Feb 2020
Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/cloud/microsoft-azure/354771/microsoft-azure-is-a-testament-to-satya-nadellas-strategic-nouse
Microsoft Azure

Microsoft Azure is a testament to Satya Nadella’s strategic nouse

14 Feb 2020