CVE-2011-2462highunder attackCWE-787

CVE-2011-2462

Published · Updated

Follow this CVE+ Monitor Adobe Acrobat+ Monitor Reader Mobile

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 89%
from disclosure to weapon38 days
Published on NVDDec 7
1st PoC+38d
metasploitDec 6
CISA KEV+3836d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
9 products (18 components)
Red Hat Desktop version 4 Extras · Red Hat Enterprise Linux AS version 4 Extras · Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux ES version 4 Extras · and others 4
fix ↗
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

Adobe Reader and Acrobat have an unspecified flaw in their U3D (3D graphics) component that allows attackers to crash the application or run malicious code by opening a specially crafted document. This vulnerability was actively exploited by criminals in December 2011.

Technical detail

A memory corruption vulnerability exists in the U3D handler of Adobe Reader/Acrobat versions 10.1.1 and earlier (Windows/Mac) and 9.x through 9.4.6 (UNIX). Remote attackers can exploit this via maliciously crafted U3D content embedded in PDFs to achieve arbitrary code execution or denial of service. The attack vector requires user interaction (opening a malicious PDF).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.