CVE-2011-2462

critical-risk

Published 2011-12-07

Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.

Do I need to act?

91.9% chance of exploitation in next 30 days

EPSS score — higher than 8% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

1 public exploit available

18366

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (2)

Acrobat

Acrobat Reader

Affected Vendors

Adobe

References (18)

Broken Link http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html

Broken Link http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html

Vendor Advisory http://www.adobe.com/support/security/advisories/apsa11-04.html

Not Applicable http://www.adobe.com/support/security/bulletins/apsb11-30.html

Not Applicable http://www.adobe.com/support/security/bulletins/apsb12-01.html

Broken Link http://www.redhat.com/support/errata/RHSA-2012-0011.html

Third Party Advisory http://www.us-cert.gov/cas/techalerts/TA11-350A.html

Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...

Broken Link http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00019.html

Broken Link http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00020.html

Vendor Advisory http://www.adobe.com/support/security/advisories/apsa11-04.html

Not Applicable http://www.adobe.com/support/security/bulletins/apsb11-30.html

Not Applicable http://www.adobe.com/support/security/bulletins/apsb12-01.html

Broken Link http://www.redhat.com/support/errata/RHSA-2012-0011.html

Third Party Advisory http://www.us-cert.gov/cas/techalerts/TA11-350A.html

Broken Link https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...

https://github.com/cisagov/vulnrichment/issues/199

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-...

/ 100

critical-risk

Severity 32/34 · Critical

Exploitability 34/34 · Critical

Exposure 7/34 · Low