جزئیات آسیب‌پذیری

Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00001.html vendor-advisoryx_refsource_SUSE
• http://www.vupen.com/english/advisories/2011/0191 vdb-entryx_refsource_VUPEN
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11586 vdb-entrysignaturex_refsource_OVAL
• http://www.adobe.com/support/security/advisories/apsa10-02.html x_refsource_CONFIRM
• http://secunia.com/advisories/43025 third-party-advisoryx_refsource_SECUNIA
• http://www.vupen.com/english/advisories/2011/0344 vdb-entryx_refsource_VUPEN
• http://security.gentoo.org/glsa/glsa-201101-08.xml vendor-advisoryx_refsource_GENTOO
• http://www.vupen.com/english/advisories/2010/2331 vdb-entryx_refsource_VUPEN
• http://www.kb.cert.org/vuls/id/491991 third-party-advisoryx_refsource_CERT-VN
• http://www.redhat.com/support/errata/RHSA-2010-0743.html vendor-advisoryx_refsource_REDHAT
• http://www.adobe.com/support/security/bulletins/apsb10-21.html x_refsource_CONFIRM
• http://www.us-cert.gov/cas/techalerts/TA10-279A.html third-party-advisoryx_refsource_CERT
• http://secunia.com/advisories/41340 third-party-advisoryx_refsource_SECUNIA
• http://community.websense.com/blogs/securitylabs/archive/2010/09/10/brief-analysis-on-adobe-reader-sing-table-parsing-vulnerability-cve-2010-2883.aspx x_refsource_MISC
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61635 vdb-entryx_refsource_XF
• http://blog.metasploit.com/2010/09/return-of-unpublished-adobe.html x_refsource_MISC
• http://www.securityfocus.com/bid/43057 vdb-entryx_refsource_BID
• http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt vendor-advisoryx_refsource_TURBO
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html vendor-advisoryx_refsource_SUSE
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-2883 government-resource