Adobe Security Bulletin

Last updated on 24 January 2023

Security updates available for Adobe Acrobat and Reader | APSB18-09

Bulletin ID	Date Published	Priority
APSB18-09	May 14, 2018	1

Summary

Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS. These updates address critical vulnerabilities whose successful exploitation could lead to arbitrary code execution in the context of the current user.

Adobe is aware of a report that an exploit for CVE-2018-4990 exists in the wild. Additionally, proof-of-concept code for CVE-2018-4993 has been published and is publicly available.

Affected Versions

Product	Track	Affected Versions	Platform
Acrobat DC	Continuous	2018.011.20038 and earlier versions	Windows and macOS
Acrobat Reader DC	Continuous	2018.011.20038 and earlier versions	Windows and macOS

Acrobat 2017	Classic 2017	2017.011.30079 and earlier versions	Windows and macOS
Acrobat Reader 2017	Classic 2017	2017.011.30079 and earlier versions	Windows and macOS

Acrobat DC	Classic 2015	2015.006.30417 and earlier versions	Windows and macOS
Acrobat Reader DC	Classic 2015	2015.006.30417 and earlier versions	Windows and macOS

For more information on Acrobat DC, please visit the Acrobat DC FAQ page.

For more information on Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page.

Solution

Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:

Users can update their product installations manually by choosing Help > Check for Updates.
The products will update automatically, without requiring user intervention, when updates are
detected.
The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.

For IT administrators (managed environments):

Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM
(Windows), or on Macintosh, Apple Remote Desktop and SSH.

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product	Track	Updated Versions	Platform	Priority Rating	Availability
Acrobat DC	Continuous	2018.011.20040	Windows and macOS	1	Windows macOS
Acrobat Reader DC	Continuous	2018.011.20040	Windows and macOS	1	Windows macOS

Acrobat 2017	Classic 2017	2017.011.30080	Windows and macOS	1	Windows macOS
Acrobat Reader DC 2017	Classic 2017	2017.011.30080	Windows and macOS	1	Windows macOS

Acrobat Reader DC (Classic 2015)	Classic 2015	2015.006.30418	Windows and macOS	1	Windows macOS
Acrobat DC (Classic 2015)	Classic 2015	2015.006.30418	Windows and macOS	1	Windows macOS

Note:

As noted in this previous announcement, support for Adobe Acrobat 11.x and Adobe Reader 11.x ended on October 15, 2017. Version 11.0.23 is the final release for Adobe Acrobat 11.x and Adobe Reader 11.x. Adobe strongly recommends that you update to the latest versions of Adobe Acrobat DC and Adobe Acrobat Reader DC. By updating installations to the latest versions, you benefit from the latest functional enhancements and improved security measures.

Vulnerability Details

Vulnerability Category	Vulnerability Impact	Severity	CVE Number
Double Free	Arbitrary Code Execution	Critical	CVE-2018-4990
Heap Overflow	Arbitrary Code Execution	Critical	CVE-2018-4947, CVE-2018-4948, CVE-2018-4966, CVE-2018-4968, CVE-2018-4978, CVE-2018-4982, CVE-2018-4984
Use-after-free	Arbitrary Code Execution	Critical	CVE-2018-4996, CVE-2018-4952, CVE-2018-4954, CVE-2018-4958, CVE-2018-4959, CVE-2018-4961, CVE-2018-4971, CVE-2018-4974, CVE-2018-4977, CVE-2018-4980, CVE-2018-4983, CVE-2018-4988, CVE-2018-4989, CVE-2018-12815
Out-of-bounds write	Arbitrary Code Execution	Critical	CVE-2018-4950
Security Bypass	Information Disclosure	Important	CVE-2018-4979
Out-of-bounds read	Information Disclosure	Important	CVE-2018-4949, CVE-2018-4951, CVE-2018-4955, CVE-2018-4956, CVE-2018-4957, CVE-2018-4960, CVE-2018-4962, CVE-2018-4963, CVE-2018-4964, CVE-2018-4967, CVE-2018-4969, CVE-2018-4970, CVE-2018-4972, CVE-2018-4973, CVE-2018-4975, CVE-2018-4976, CVE-2018-4981, CVE-2018-4986, CVE-2018-4985
Type Confusion	Arbitrary Code Execution	Critical	CVE-2018-4953, CVE-2018-12812
Untrusted pointer dereference	Arbitrary Code Execution	Critical	CVE-2018-4987
Memory Corruption	Information Disclosure	Important	CVE-2018-4965
NTLM SSO hash theft	Information Disclosure	Important	CVE-2018-4993
HTTP POST new line injection via XFA submission	Security Bypass	Important	CVE-2018-4995

Note:

Please refer to this KB article for more information on mitigating CVE-2018-4993. An additional mitigation for CVE-2018-4993 is available to admins that results in blocking PDF actions that open links, including GoToE, GoToR, Launch, Thread, Import Data, Export Form Data, Submit Form, and Reset Form. For more details, refer to this documentation.

Acknowledgements

Adobe would like to thank the following individuals and organizations for reporting the
relevant issues and for working with Adobe to help protect our customers:

Aleksandar Nikolic of Cisco Talos (CVE-2018-4996, CVE-2018-4947, CVE-2018-12812, CVE-2018-12815)
Anton Cherepanov, ESET and Matt Oh, Microsoft (CVE-2018-4990)
Vladislav Stolyarov of Kaspersky Lab (CVE-2018-4988, CVE-2018-4987)
Yoav Alon and Netanel Ben-Simon from Check Point Software Technologies (CVE-2018-4985)
Gal De Leon of Palo Alto Networks (CVE-2018-4959, CVE-2018-4961)
Ke Liu of Tencent's Xuanwu Lab (CVE-2018-4949, CVE-2018-4966, CVE-2018-4955, CVE-2018-4951, CVE-2018-4964, CVE-2018-4963, CVE-2018-4960, CVE-2018-4986)
Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-4950, CVE-2018-4951, CVE-2018-4952, CVE-2018-4953, CVE-2018-4954, CVE-2018-4962, CVE-2018-4974)
WillJ of Tencent PC Manager via Trend Micro's Zero Day Initiative (CVE-2018-4948, CVE-2018-4949, CVE-2018-4955, CVE-2018-4971, CVE-2018-4973)
Riusksk of Tencent Security Platform Department via Trend Micro's Zero Day Initiative (CVE-2018-4956, CVE-2018-4957)
Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-4949, CVE-2018-4951, CVE-2018-4960, CVE-2018-4963, CVE-2018-4964, CVE-2018-4965, CVE-2018-4966, CVE-2018-4968, CVE-2018-4969)
Ke Liu of Tencent's Xuanwu LAB working via Trend Micro's Zero Day Initiative (CVE-2018-4967, CVE-2018-4970, CVE-2018-4972, CVE-2018-4975, CVE-2018-4976, CVE-2018-4978, CVE-2018-4981, CVE-2018-4982, CVE-2018-4990)
Sebastian Apelt siberas via Trend Micro's Zero Day Initiative (CVE-2018-4977)
AbdulAziz Hariri via Trend Micro's Zero Day Initiative (CVE-2018-4979, CVE-2018-4980, CVE-2018-4984)
Hui Gao of Palo Alto Networks and Heige (a.k.a. SuperHei) from Knownsec 404 Security Team (CVE-2018-4958, CVE-2018-4983)
Cybellum Technologies LTD (CVE-2018-4989)
Alex from Cure53 (CVE-2018-4995)
Assaf Baharav, Yaron Fruchtmann and Ido Solomon of Check Point Software Technologies (CVE-2018-4993)

Revisions

May 15, 2018: Added language to notify users that an exploit for CVE-2018-4990 exists in the wild, and that proof-of-concept code for CVE-2018-4985 has been published and is publicly available. Also added CVE-2018-4995 to replace CVE-2018-4994, which was already assigned to an unrelated vulnerability in Adobe Connect. Finally, added CVE-2018-4996 to replace CVE-2018-4946, which was already assigned to an unrelated vulnerability in Adobe Photoshop.

May 16, 2018: Corrected the summary section by replacing CVE-2018-4985 with CVE-2018-4993. Proof-of-concept code is publicly available for CVE-2018-4993, and not CVE-2018-4985.

May 17, 2018: Added a link to documentation that describes an additional mitigation for CVE-2018-4993 that will block users from following links in PDF documents.

May 25, 2018: Modified the track name "Consumer" to "Continuous" to align with previous bulletins.

February 5, 2019: Updated Acknowledgments section

Adobe

Get help faster and easier

New user?