Two Critical Flaws Patched in Adobe Acrobat, Reader

[silversurfer]

Adobe’s first round of security updates for 2019 resolve two critical vulnerabilities in the company’s Acrobat and Reader products, but administrators should not be too concerned about the flaws being exploited in the wild any time soon.

The latest versions of Acrobat DC, Acrobat Reader DC, Acrobat 2017 and Acrobat Reader DC 2017 for Windows and macOS patch a use-after-free bug that can lead to arbitrary code execution in the context of the current user (CVE-2018-16011), and a security bypass issue that can result in privilege escalation (CVE-2018-19725).

The first vulnerability was discovered by Sebastian Apelt and the second by Abdul Aziz Hariri. Both security holes were reported to Adobe via Trend Micro’s Zero Day Initiative (ZDI).

While both flaws are considered critical, Adobe has assigned them a priority rating of 2, which means exploits are not imminent and administrators are advised to install the patches within 30 days.

Source: https://www.securityweek.com/two-critica...bat-reader