VulnerabilityAnalyzed

CVE-2010-0188

Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability

KEVHIGH 7.8EPSS 88.2%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 88.25% probability · 100th percentile
CISA KEV: Listed 3 March 2022 · due 24 March 2022 · used in ransomware campaigns
Affected: adobe/acrobat · adobe/acrobat reader
Source: psirt@adobe.com

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-0188

References

http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/38639Broken Link, Vendor Advisory
http://secunia.com/advisories/38915Broken Link
http://securitytracker.com/id?1023601Broken Link, Third Party Advisory, VDB Entry
http://www.adobe.com/support/security/bulletins/apsb10-07.htmlBroken Link, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0114.htmlBroken Link, Vendor Advisory
http://www.securityfocus.com/bid/38195Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2010/0399Broken Link, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56297Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8697Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/38639Broken Link, Vendor Advisory
http://secunia.com/advisories/38915Broken Link
http://securitytracker.com/id?1023601Broken Link, Third Party Advisory, VDB Entry
http://www.adobe.com/support/security/bulletins/apsb10-07.htmlBroken Link, Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2010-0114.htmlBroken Link, Vendor Advisory
http://www.securityfocus.com/bid/38195Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2010/0399Broken Link, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56297Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8697Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-0188US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.