CVE-2011-2436: Buffer Overflow

Published Sep 15, 2011

Updated

Heap-based buffer overflow in the image-parsing library in Adobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1 allows attackers to execute arbitrary code via unspecified vectors.

Affected Software

74 affected components

Adobe Acrobat reader=8.1.6

Adobe Acrobat reader=10.0

Adobe Acrobat reader=8.2.3

Adobe Acrobat reader=9.4.3

Adobe Acrobat reader=8.2.6

Adobe Acrobat reader=8.2

Adobe Acrobat reader=10.0.3

Adobe Acrobat reader=9.2

Adobe Acrobat reader=8.2.2

Adobe Acrobat reader=9.1

Adobe Acrobat reader=8.2.4

Adobe Acrobat reader=9.1.3

Adobe Acrobat reader=8.0

Adobe Acrobat reader=9.1.2

Adobe Acrobat reader=8.1.5

Adobe Acrobat reader=9.3.3

Adobe Acrobat reader=9.4.2

Adobe Acrobat reader=9.1.1

Adobe Acrobat reader=8.2.1

Adobe Acrobat reader=8.3

Adobe Acrobat reader=8.1.7

Adobe Acrobat reader=8.1.4

Adobe Acrobat reader=9.3.4

Adobe Acrobat reader=8.1.2

Adobe Acrobat reader=9.3

Adobe Acrobat reader=9.0

Adobe Acrobat reader=9.4

Adobe Acrobat reader=8.1.1

Adobe Acrobat reader=9.3.2

Adobe Acrobat reader=8.1

Adobe Acrobat reader=10.0.1

Adobe Acrobat reader=8.1.3

Adobe Acrobat reader=9.4.4

Adobe Acrobat reader=9.3.1

Adobe Acrobat reader=10.0.2

Adobe Acrobat reader=9.4.1

Adobe Acrobat=8.0

Adobe Acrobat=8.1.7

Adobe Acrobat=8.2.1

Adobe Acrobat=9.3.3

Adobe Acrobat=10.1

Adobe Acrobat=8.1.2

Adobe Acrobat=9.4.2

Adobe Acrobat=9.2

Adobe Acrobat=9.1

Adobe Acrobat=10.0

Adobe Acrobat=9.4.3

Adobe Acrobat=8.2.4

Adobe Acrobat=8.1.1

Adobe Acrobat=10.0.3

Adobe Acrobat=9.4.4

Adobe Acrobat=8.2.3

Adobe Acrobat=8.2

Adobe Acrobat=8.1

Adobe Acrobat=9.0

Adobe Acrobat=9.3.4

Adobe Acrobat=8.2.2

Adobe Acrobat=9.4.1

Adobe Acrobat=9.3.2

Adobe Acrobat=9.1.1

Adobe Acrobat=8.1.5

Adobe Acrobat=8.1.4

Adobe Acrobat=9.3.1

Adobe Acrobat=8.2.6

Adobe Acrobat=9.1.2

Adobe Acrobat=10.0.2

Adobe Acrobat=8.1.6

Adobe Acrobat=10.0.1

Adobe Acrobat=9.1.3

Adobe Acrobat=9.4.5

Adobe Acrobat=8.2.5

Adobe Acrobat=8.1.3

Adobe Acrobat=9.4

Adobe Acrobat=9.3

Remediation

Patch Available

http://www.adobe.com/support/security/bulletins/apsb11-24.html

Event History

Sep 15, 2011

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-2436?

CVE-2011-2436 is rated as critical due to potential arbitrary code execution by attackers.

How do I fix CVE-2011-2436?

To mitigate CVE-2011-2436, update Adobe Reader and Acrobat to version 8.3.1 or later for 8.x, 9.4.6 or later for 9.x, and 10.1.1 or later for 10.x.

Which versions of Adobe Reader are affected by CVE-2011-2436?

CVE-2011-2436 affects Adobe Reader and Acrobat 8.x before 8.3.1, 9.x before 9.4.6, and 10.x before 10.1.1.

What types of attacks can exploit CVE-2011-2436?

Attackers can exploit CVE-2011-2436 to execute arbitrary code through specially crafted images.

Is it possible to detect an exploit of CVE-2011-2436?

Detection of an exploit for CVE-2011-2436 requires monitoring for unusual activity and signatures associated with malicious image payloads.