Engineers at Adobe Systems have been busy after the company released patches to plug 17 critical security holes affecting Adobe Reader and Acrobat.
Among the fixes is a patch for a zero-day vulnerability that impacted not only Reader and Acrobat, but versions of Adobe Flash Player as well, on multiple operating systems. Earlier in June, attackers were seen using the bug to plant backdoor Trojans on vulnerable machines.
“[The June 29] update includes changes to resolve the misuse of this command,” blogged Steve Gottwals, group product manager for Adobe Reader. “We added functionality to block any attempts to launch an executable or other harmful objects by default. We also altered the way the existing warning dialog works to thwart the known social engineering attacks.”
When the feature is enabled, the user will get a warning message when opening attachments.
Almost all the vulnerabilities are known to leave users open to arbitrary code execution. The one exception is CVE-2010-2204, a remote memory corruption vulnerability that can cause programs to crash.
According to Adobe, arbitrary code execution has not been demonstrated, but may be possible.
Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector
Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…
Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…
Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…
Explore the future of work with the Silicon In Focus Podcast. Discover how AI is…
Executive hits out at the DoJ's “staggering proposal” to force Google to sell off its…