CVE-2010-2208 — Code Injection in Adobe Acrobat

CWE-94 — Code Injection5 documents4 sources
Severity
9.3CRITICALNVD
EPSS
3.0%
top 13.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe AcrobatAdobe Acrobat Reader
Timeline
PublishedJun 30
Latest updateMay 14

Description

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, dereference a heap object after this object's deletion, which allows attackers to execute arbitrary code via unspecified vectors.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDadobe/acrobat_reader19 versions+18
▶NVDadobe/acrobat21 versions+20

Patches

Patch: www.adobe.com ↗Patch: www.adobe.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-2f8f-mr6r-cvh9: Adobe Reader and Acrobat 9↗2022-05-14
▶

📋Vendor Advisories

1
Red Hat
acroread: multiple code execution flaws (APSB10-15)↗2010-06-29
▶

💬Community

2
Bugzilla
CVE-2010-2595 libtiff: Array index error due improper handling of invalid ReferenceBlackWhite values↗2010-07-02
▶
Bugzilla
acroread: multiple code execution flaws (APSB10-15)↗2010-06-29
▶
CVE-2010-2208 — Code Injection in Adobe Acrobat | cvebase