Actively exploited · Published Feb 14, 2013 · Assigned by adobe
CVE-2013-0641
High 7.8 Exploited
In plain English
A high-severity buffer overflow in Reader from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 32.3% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 24, 2022.
Official description
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html x_refsource_CONFIRM
- VU#422807 third-party-advisory, x_refsource_CERT-VN
- openSUSE-SU-2013:0335 vendor-advisory, x_refsource_SUSE
- http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html x_refsource_MISC
- openSUSE-SU-2013:0342 vendor-advisory, x_refsource_SUSE
- RHSA-2013:0551 vendor-advisory, x_refsource_REDHAT
- http://www.adobe.com/support/security/bulletins/apsb13-07.html x_refsource_CONFIRM
- http://blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploit x_refsource_MISC
- SUSE-SU-2013:0349 vendor-advisory, x_refsource_SUSE
- oval:org.mitre.oval:def:16296 vdb-entry, signature, x_refsource_OVAL
- http://www.adobe.com/support/security/advisories/apsa13-02.html x_refsource_CONFIRM
- GLSA-201308-03 vendor-advisory, x_refsource_GENTOO
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0641 government-resource