Main Vulnerability Database Vulnerabilities #VU3489

Improper input validation in Adobe Acrobat and Adobe Reader - CVE-2010-2888

Published: January 5, 2017

Vulnerability identifier: #VU3489

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2010-2888

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error within ActiveX component when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it in Internet Explorer, cause memory corruption and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Affected software

Adobe Acrobat
Adobe Reader

How to mitigate CVE-2010-2888

Install the latest version from vendor's website. The vulnerability is fixed in Adobe Reader and Acrobat 9.4 and 8.2.5.

External References

http://www.adobe.com/support/security/bulletins/apsb10-21.html

Related Security Bulletins