Adobe with a week of delay on the roadmap has released security updates to fix critical vulnerabilities in Acrobat and Reader PDF.

Adobe has finally released critical security updates for its products Reader and Acrobat PDF software. The vulnerabilities fixed with these updates have been targeted by hackers in numerous cyber attacks worldwide.

The security updates for Adobe Reader and Acrobat are available for Windows and Macintosh computers and fix eight vulnerabilities.

“Adobe has released security updates for Adobe Reader and Acrobat for Windows and Macintosh. These updates address vulnerabilities that could potentially allow an attacker to take over the affected system.” states the Adobe Security Bulletin.

The updates were originally scheduled to be released a week ago, but were delayed due to issues emerged during the development phase.

Five of eight flaws could be exploited by attackers for remote code execution, the other three vulnerabilities are:

• a sandbox bypass vulnerability and could be exploited by an attacked to escalate privileges on Windows machines.
• a denial-of-service (DoS) vulnerability related to memory corruption.
• a cross-site scripting (XSS) flaw that affects only Mac OS.

The vulnerabilities are identified by the following CVE Numbers:

CVE-2014-0560, CVE-2014-0561, CVE-2014-0562, CVE-2014-0563, CVE-2014-0565, CVE-2014-0566, CVE-2014-0567, CVE-2014-0568

• Reader on Windows
• Reader on Mac
• Acrobat Standard and Pro on Windows
• Acrobat Standard and Pro on Mac

Pierluigi Paganini

(Security Affairs – Adobe products,security updates, Patch Management)