US-CERT Cyber Security Alert SA11-350A -- Adobe Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1                       National Cyber Alert System                    Cyber Security Alert SA11-350A   Adobe Updates for Multiple Vulnerabilities     Original release date: December 16, 2011    Last revised: --    Source: US-CERT   Systems Affected       * Adobe Reader X (10.1.1) and earlier 10.x versions for Windows and Macintosh      * Adobe Reader 9.4.6 and earlier 9.x versions for Windows, Macintosh, and UNIX      * Adobe Acrobat X (10.1.1) and earlier 10.x versions for Windows and Macintosh      * Adobe Acrobat 9.4.6 and earlier 9.x versions for Windows and Macintosh   Overview     Adobe has released Security Bulletin APSB11-30, which describes    multiple vulnerabilities affecting Adobe Reader and Acrobat.   Solution     Update Reader     Adobe has released updates to address this issue. Users are    encouraged to read Adobe Security Bulletin APSB11-30 and update    vulnerable versions of Adobe Reader and Acrobat.     Do not access PDF files from untrusted sources     Do not open unfamiliar or unexpected PDF files, particularly those    hosted on websites or delivered as email attachments. Please see    Cyber Security Tip ST04-010.   Description     Adobe Security Bulletin APSB11-30 and Adobe Security Advisory    APSA11-04 describe a number of vulnerabilities affecting Adobe    Reader and Acrobat. These vulnerabilities affect Reader and Acrobat    9.4.6 and earlier 9.x versions. These vulnerabilities also affect    Reader X and Acrobat X 10.1.1 and earlier 10.x versions.     An attacker could exploit these vulnerabilities by convincing a    user to open a specially crafted PDF file. The Adobe Reader browser    plug-in, which can automatically open PDF documents hosted on a    website, is available for multiple web browsers and operating    systems.     Adobe Reader X and Adobe Acrobat X will be patched in the next    quarterly update scheduled for January 10, 2012.     Additional details for the U3D memory corruption vulnerability can    be found in US-CERT Vulnerability Note VU#759307.   References   * Security update available for Adobe Reader and Acrobat -    <https://www.adobe.com/support/security/bulletins/apsb11-30.html>   * Adobe Acrobat and Reader U3D memory corruption vulnerability -    <http://www.kb.cert.org/vuls/id/759307>   * Security Advisory for Adobe Reader and Acrobat -    <https://www.adobe.com/support/security/advisories/apsa11-04.html>   ____________________________________________________________________     The most recent version of this document can be found at:       <http://www.us-cert.gov/cas/alerts/SA11-350A.html>  ____________________________________________________________________     Feedback can be directed to US-CERT Technical Staff. Please send    email to <cert@cert.org> with "SA11-350A Feedback VU#759307" in    the subject.  ____________________________________________________________________     For instructions on subscribing to or unsubscribing from this    mailing list, visit <http://www.us-cert.gov/cas/signup.html>.  ____________________________________________________________________     Produced 2011 by US-CERT, a government organization.     Terms of use:       <http://www.us-cert.gov/legal.html>  ____________________________________________________________________  Revision History    December 16, 2011: Initial release   -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux)  iQEVAwUBTuucYD/GkGVXE7GMAQIXSQf8D8pJFE4lWQpYI1c/Ezs9B86qWzwtod+O UdJ4ImEbUyXCRUYwzfdQvzqZgpCfH1fKTH1D28XSpueLw9oz7P9KJ2d38wGns3x1 Or0+ZSRzTEy7iJVcg2a06Y4PGl0FauwS1OZp5qc9PmbHRdw8SWZF22yu0qwLO0or 4HGtj2+lg1wnqaWTR95Z9ZJ/ChroHTFgAIgEBLdmIn3gVKfg0cRTIxlgE9QHh8Qh JuGXZXHhbDladtgur775s9GVMOGz14dSRr9RZLCEWdu5fBbh0g3ZUdl/RUdViP1r A57Ws6J8erMIcjjgqmPIEOi5fRYuQFIYumSHoPUIf+lReg1CID/h0A== =Nl92 -----END PGP SIGNATURE-----