Description
Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | acroread +1 | 9.3.1-1.el5 | RHSA-2010:0114 |
| RHEL 4 | acroread +1 | 9.3.1-1.el4 | RHSA-2010:0114 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Adobe Acrobat Bundled LibTIFF Integer Overflow
exploit/windows/fileformat/adobe_libtiff
Exploit-DB 4
- Apple iOS Mobile Safari - LibTIFF Buffer Overflow (Metasploit) EDB-21868 · remote · Oct 9, 2012 · verified
- Apple iOS Mobile Mail - LibTIFF Buffer Overflow (Metasploit) EDB-21869 · remote · Oct 9, 2012 · verified
- Adobe Acrobat - Bundled LibTIFF Integer Overflow (Metasploit) EDB-16670 · local · Sep 25, 2010 · verified
- Adobe Reader PDF - LibTiff Integer Overflow Code Execution EDB-11787 · local · Mar 17, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2010:0114 Red Hat Security Advisory: acroread security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- ADV-2010-0399 vdb-entry
- adobe-unspec-priv-escalation(56297) vdb-entry
- RHSA-2010:0114 vendor-advisory
- SUSE-SR:2010:006 vendor-advisory
- oval:org.mitre.oval:def:8697 vdb-entry signature
- http://www.adobe.com/support/security/bulletins/apsb10-07.html
- 38639 third-party-advisory
- 38195 vdb-entry
- 1023601 vdb-entry
- 38915 third-party-advisory