Acrobat
by Adobe Inc.
CVEs (2,141)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-5331 | 0.00 | — | 0.02 | Dec 5, 2008 | Adobe Acrobat 9 uses more efficient encryption than previous versions, which makes it easier for attackers to guess a document's password via a brute-force attack. | |||
| CVE-2008-4816 | 0.00 | — | 0.02 | Nov 5, 2008 | Unspecified vulnerability in the Download Manager in Adobe Reader 8.1.2 and earlier on Windows allows remote attackers to change Internet Security options on a client machine via unknown vectors. | |||
| CVE-2008-2042 | 0.00 | — | 0.05 | May 8, 2008 | The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file that invokes app.checkForUpdate with a malicious callback… | |||
| CVE-2008-0883 | 0.00 | — | 0.01 | Mar 6, 2008 | acroread in Adobe Acrobat Reader 8.1.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files related to SSL certificate handling. | |||
| CVE-2007-5666 | 0.00 | — | 0.01 | Feb 12, 2008 | Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicious Security Provider library in the reader's current working directory. NOTE: this issue might be subsumed by CVE-2008-0655. | |||
| CVE-2006-3452 | 0.00 | — | 0.01 | Jul 12, 2006 | Adobe Reader and Acrobat 6.0.4 and earlier, on Mac OSX, has insecure file and directory permissions, which allows local users to gain privileges by overwriting program files. | |||
| CVE-2006-3093 | 0.00 | — | 0.06 | Jun 19, 2006 | Multiple unspecified vulnerabilities in Adobe Acrobat Reader (acroread) before 7.0.8 have unknown impact and unknown vectors. | |||
| CVE-2006-1627 | 0.00 | — | 0.04 | Apr 13, 2006 | Adobe Document Server for Reader Extensions 6.0 does not provide proper access control, which allows remote authenticated users to perform privileged actions by modifying the (1) actionID and (2) pageID parameters. NOTE: due to an error during reservation, this identifier was… | |||
| CVE-2006-0525 | 0.00 | — | 0.01 | Feb 2, 2006 | Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs. | |||
| CVE-2005-1841 | 0.00 | — | 0.01 | Jul 7, 2005 | The control for Adobe Reader 5.0.9 and 5.0.10 on Linux, Solaris, HP-UX, and AIX creates temporary files with the permissions as specified in a user's umask, which could allow local users to read PDF documents of that user if the umask allows it. | |||
| CVE-2005-1625 | 0.00 | — | 0.05 | Jul 5, 2005 | Stack-based buffer overflow in the UnixAppOpenFilePerform function in Adobe Reader 5.0.9 and 5.0.10 for Unix allows remote attackers to execute arbitrary code via a PDF document with a long /Filespec tag. | |||
| CVE-2005-0492 | 0.00 | — | 0.02 | May 2, 2005 | Adobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers to cause a denial of service (application crash) via a PDF file that contains a negative Count value in the root page node. | |||
| CVE-2005-1347 | 0.00 | — | 0.05 | May 2, 2005 | ** UNVERIFIABLE ** NOTE: this issue describes a problem that can not be independently verified as of 20050421. Adobe Acrobat reader (AcroRd32.exe) 6.0 and earlier allows remote attackers to cause a denial of service ("Invalid-ID-Handle-Error" error) and modify memory beginning… | |||
| CVE-2005-0035 | 0.00 | — | 0.03 | May 2, 2005 | The Acrobat web control in Adobe Acrobat and Acrobat Reader 7.0 and earlier, when used with Internet Explorer, allows remote attackers to determine the existence of arbitrary files via the LoadFile ActiveX method. | |||
| CVE-2004-1598 | 0.00 | — | 0.03 | Oct 12, 2004 | Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) file that references files outside of the temporary directory. | |||
| CVE-2003-0142 | 0.00 | — | 0.02 | Aug 18, 2003 | Adobe Acrobat Reader (acroread) 6, under certain circumstances when running with the "Certified plug-ins only" option disabled, loads plug-ins with signatures used for older versions of Acrobat, which can allow attackers to cause Acrobat to enter Certified mode and run untrusted… | |||
| CVE-2003-0284 | 0.00 | — | 0.02 | Jun 16, 2003 | Adobe Acrobat 5 does not properly validate JavaScript in PDF files, which allows remote attackers to write arbitrary files into the Plug-ins folder that spread to other PDF documents, as demonstrated by the W32.Yourde virus. | |||
| CVE-2002-0030 | 0.00 | — | 0.01 | Apr 2, 2003 | The digital signature mechanism for the Adobe Acrobat PDF viewer only verifies the PE header of executable code for a plug-in, which can allow attackers to execute arbitrary code in certified mode by making the plug-in appear to be signed by Adobe. | |||
| CVE-2002-1764 | 0.00 | — | 0.01 | Dec 31, 2002 | acroread in Adobe Acrobat Reader 4.05 on Linux allows local users to overwrite arbitrary files via a symlink attack on temporary files. | |||
| CVE-2001-1069 | 0.00 | — | 0.01 | Aug 31, 2001 | libCoolType library as used in Adobe Acrobat (acroread) on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to modify the file and possibly modify acroread's behavior. |
- CVE-2008-5331Dec 5, 2008risk 0.00cvss —epss 0.02
Adobe Acrobat 9 uses more efficient encryption than previous versions, which makes it easier for attackers to guess a document's password via a brute-force attack.
- CVE-2008-4816Nov 5, 2008risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Download Manager in Adobe Reader 8.1.2 and earlier on Windows allows remote attackers to change Internet Security options on a client machine via unknown vectors.
- CVE-2008-2042May 8, 2008risk 0.00cvss —epss 0.05
The Javascript API in Adobe Acrobat Professional 7.0.9 and possibly 8.1.1 exposes a dangerous method, which allows remote attackers to execute arbitrary commands or trigger a buffer overflow via a crafted PDF file that invokes app.checkForUpdate with a malicious callback…
- CVE-2008-0883Mar 6, 2008risk 0.00cvss —epss 0.01
acroread in Adobe Acrobat Reader 8.1.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files related to SSL certificate handling.
- CVE-2007-5666Feb 12, 2008risk 0.00cvss —epss 0.01
Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.1 and earlier allows local users to execute arbitrary code via a malicious Security Provider library in the reader's current working directory. NOTE: this issue might be subsumed by CVE-2008-0655.
- CVE-2006-3452Jul 12, 2006risk 0.00cvss —epss 0.01
Adobe Reader and Acrobat 6.0.4 and earlier, on Mac OSX, has insecure file and directory permissions, which allows local users to gain privileges by overwriting program files.
- CVE-2006-3093Jun 19, 2006risk 0.00cvss —epss 0.06
Multiple unspecified vulnerabilities in Adobe Acrobat Reader (acroread) before 7.0.8 have unknown impact and unknown vectors.
- CVE-2006-1627Apr 13, 2006risk 0.00cvss —epss 0.04
Adobe Document Server for Reader Extensions 6.0 does not provide proper access control, which allows remote authenticated users to perform privileged actions by modifying the (1) actionID and (2) pageID parameters. NOTE: due to an error during reservation, this identifier was…
- CVE-2006-0525Feb 2, 2006risk 0.00cvss —epss 0.01
Multiple Adobe products, including (1) Photoshop CS2, (2) Illustrator CS2, and (3) Adobe Help Center, install a large number of .EXE and .DLL files with write-access permission for the Everyone group, which allows local users to gain privileges via Trojan horse programs.
- CVE-2005-1841Jul 7, 2005risk 0.00cvss —epss 0.01
The control for Adobe Reader 5.0.9 and 5.0.10 on Linux, Solaris, HP-UX, and AIX creates temporary files with the permissions as specified in a user's umask, which could allow local users to read PDF documents of that user if the umask allows it.
- CVE-2005-1625Jul 5, 2005risk 0.00cvss —epss 0.05
Stack-based buffer overflow in the UnixAppOpenFilePerform function in Adobe Reader 5.0.9 and 5.0.10 for Unix allows remote attackers to execute arbitrary code via a PDF document with a long /Filespec tag.
- CVE-2005-0492May 2, 2005risk 0.00cvss —epss 0.02
Adobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers to cause a denial of service (application crash) via a PDF file that contains a negative Count value in the root page node.
- CVE-2005-1347May 2, 2005risk 0.00cvss —epss 0.05
** UNVERIFIABLE ** NOTE: this issue describes a problem that can not be independently verified as of 20050421. Adobe Acrobat reader (AcroRd32.exe) 6.0 and earlier allows remote attackers to cause a denial of service ("Invalid-ID-Handle-Error" error) and modify memory beginning…
- CVE-2005-0035May 2, 2005risk 0.00cvss —epss 0.03
The Acrobat web control in Adobe Acrobat and Acrobat Reader 7.0 and earlier, when used with Internet Explorer, allows remote attackers to determine the existence of arbitrary files via the LoadFile ActiveX method.
- CVE-2004-1598Oct 12, 2004risk 0.00cvss —epss 0.03
Adobe Acrobat and Acrobat Reader 6.0 allow remote attackers to read arbitrary files via a PDF file that contains an embedded Shockwave (swf) file that references files outside of the temporary directory.
- CVE-2003-0142Aug 18, 2003risk 0.00cvss —epss 0.02
Adobe Acrobat Reader (acroread) 6, under certain circumstances when running with the "Certified plug-ins only" option disabled, loads plug-ins with signatures used for older versions of Acrobat, which can allow attackers to cause Acrobat to enter Certified mode and run untrusted…
- CVE-2003-0284Jun 16, 2003risk 0.00cvss —epss 0.02
Adobe Acrobat 5 does not properly validate JavaScript in PDF files, which allows remote attackers to write arbitrary files into the Plug-ins folder that spread to other PDF documents, as demonstrated by the W32.Yourde virus.
- CVE-2002-0030Apr 2, 2003risk 0.00cvss —epss 0.01
The digital signature mechanism for the Adobe Acrobat PDF viewer only verifies the PE header of executable code for a plug-in, which can allow attackers to execute arbitrary code in certified mode by making the plug-in appear to be signed by Adobe.
- CVE-2002-1764Dec 31, 2002risk 0.00cvss —epss 0.01
acroread in Adobe Acrobat Reader 4.05 on Linux allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2001-1069Aug 31, 2001risk 0.00cvss —epss 0.01
libCoolType library as used in Adobe Acrobat (acroread) on Linux creates the AdobeFnt.lst file with world-writable permissions, which allows local users to modify the file and possibly modify acroread's behavior.
Page 107 of 108