Skip to navigation

Security Advisory Critical: acroread security update

Advisory: RHSA-2011:1434-1
Type: Security Advisory
Severity: Critical
Issued on: 2011-11-08
Last updated on: 2011-11-08
Affected Products: RHEL Desktop Supplementary (v. 5 client)
RHEL Supplementary (v. 5 server)
Red Hat Enterprise Linux Desktop Supplementary (v. 6)
Red Hat Enterprise Linux Extras (v. 4)
Red Hat Enterprise Linux Server Supplementary (v. 6)
Red Hat Enterprise Linux Server Supplementary EUS (v. 6.1.z)
Red Hat Enterprise Linux Workstation Supplementary (v. 6)
CVEs (cve.mitre.org): CVE-2011-2094
CVE-2011-2095
CVE-2011-2096
CVE-2011-2097
CVE-2011-2098
CVE-2011-2099
CVE-2011-2101
CVE-2011-2104
CVE-2011-2105
CVE-2011-2107
CVE-2011-2130
CVE-2011-2134
CVE-2011-2135
CVE-2011-2136
CVE-2011-2137
CVE-2011-2138
CVE-2011-2139
CVE-2011-2140
CVE-2011-2414
CVE-2011-2415
CVE-2011-2416
CVE-2011-2417
CVE-2011-2424
CVE-2011-2425
CVE-2011-2426
CVE-2011-2427
CVE-2011-2428
CVE-2011-2429
CVE-2011-2430
CVE-2011-2431
CVE-2011-2432
CVE-2011-2433
CVE-2011-2434
CVE-2011-2435
CVE-2011-2436
CVE-2011-2437
CVE-2011-2438
CVE-2011-2439
CVE-2011-2440
CVE-2011-2442
CVE-2011-2444
CVE-2011-4374

Details

Updated acroread packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise
Linux 5 and 6 Supplementary.

The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Adobe Reader allows users to view and print documents in Portable Document
Format (PDF).

This update fixes multiple security flaws in Adobe Reader. These flaws are
detailed on the Adobe security page APSB11-24, listed in the References
section. A specially-crafted PDF file could cause Adobe Reader to crash or,
potentially, execute arbitrary code as the user running Adobe Reader when
opened. (CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434,
CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439,
CVE-2011-2440, CVE-2011-2442)

This update also fixes multiple security flaws in Adobe Flash Player
embedded in Adobe Reader. These flaws are detailed on the Adobe security
pages APSB11-21 and APSB11-26, listed in the References section.

A PDF file with an embedded, specially-crafted SWF file could cause Adobe
Reader to crash or, potentially, execute arbitrary code as the user running
Adobe Reader when opened. (CVE-2011-2130, CVE-2011-2134, CVE-2011-2135,
CVE-2011-2136, CVE-2011-2137, CVE-2011-2138, CVE-2011-2139, CVE-2011-2140,
CVE-2011-2414, CVE-2011-2415, CVE-2011-2416, CVE-2011-2417, CVE-2011-2424,
CVE-2011-2425, CVE-2011-2426, CVE-2011-2427, CVE-2011-2428, CVE-2011-2430)

A flaw in Adobe Flash Player could allow an attacker to conduct cross-site
scripting (XSS) attacks if a victim were tricked into visiting a
specially-crafted web page. (CVE-2011-2444)

This update also fixes an information disclosure flaw in Adobe Flash
Player. (CVE-2011-2429)

All Adobe Reader users should install these updated packages. They contain
Adobe Reader version 9.4.6, which is not vulnerable to these issues. All
running instances of Adobe Reader must be restarted for the update to take
effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

RHEL Desktop Supplementary (v. 5 client)

IA-32:
acroread-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 6f965eb28609865c68b55b7fb4d7d850
SHA-256: 1cedda9dddd5e04686d014916fb8f234c459f7105afce0a33c2adc454ca281e8
acroread-plugin-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 78f11e0239620ec2584703ad76bde35f
SHA-256: 1a9167a57e8d8da42690d94a27141e97bc89ab266a6e3496d89ffa5d6680a9b7
 
x86_64:
acroread-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 6f965eb28609865c68b55b7fb4d7d850
SHA-256: 1cedda9dddd5e04686d014916fb8f234c459f7105afce0a33c2adc454ca281e8
acroread-plugin-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 78f11e0239620ec2584703ad76bde35f
SHA-256: 1a9167a57e8d8da42690d94a27141e97bc89ab266a6e3496d89ffa5d6680a9b7
 
RHEL Supplementary (v. 5 server)

IA-32:
acroread-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 6f965eb28609865c68b55b7fb4d7d850
SHA-256: 1cedda9dddd5e04686d014916fb8f234c459f7105afce0a33c2adc454ca281e8
acroread-plugin-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 78f11e0239620ec2584703ad76bde35f
SHA-256: 1a9167a57e8d8da42690d94a27141e97bc89ab266a6e3496d89ffa5d6680a9b7
 
x86_64:
acroread-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 6f965eb28609865c68b55b7fb4d7d850
SHA-256: 1cedda9dddd5e04686d014916fb8f234c459f7105afce0a33c2adc454ca281e8
acroread-plugin-9.4.6-1.el5.i386.rpm
File outdated by:  RHSA-2013:1402
    MD5: 78f11e0239620ec2584703ad76bde35f
SHA-256: 1a9167a57e8d8da42690d94a27141e97bc89ab266a6e3496d89ffa5d6680a9b7
 
Red Hat Enterprise Linux Desktop Supplementary (v. 6)

IA-32:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
x86_64:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
Red Hat Enterprise Linux Extras (v. 4)

IA-32:
acroread-9.4.6-1.el4.i386.rpm
File outdated by:  RHSA-2012:0011
    MD5: 7fbef0d1d3054cd014a0946f087be7be
SHA-256: 8c891fedbb1d48df6110bbeafa9cdbe3106b8fc3657f1422f60c487f74416b40
acroread-plugin-9.4.6-1.el4.i386.rpm
File outdated by:  RHSA-2012:0011
    MD5: 4e61144efc462a460d1736f80f9a3800
SHA-256: 10adf44624c83cf1c3037255df9ebc637eff0653a4c5cb5b83f3bb57d2668e75
 
x86_64:
acroread-9.4.6-1.el4.i386.rpm
File outdated by:  RHSA-2012:0011
    MD5: 7fbef0d1d3054cd014a0946f087be7be
SHA-256: 8c891fedbb1d48df6110bbeafa9cdbe3106b8fc3657f1422f60c487f74416b40
 
Red Hat Enterprise Linux Server Supplementary (v. 6)

IA-32:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
x86_64:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
Red Hat Enterprise Linux Server Supplementary EUS (v. 6.1.z)

IA-32:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2012:0011
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2012:0011
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
x86_64:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2012:0011
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2012:0011
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
Red Hat Enterprise Linux Workstation Supplementary (v. 6)

IA-32:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
x86_64:
acroread-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: bbdbbbe70753b3ca7340eee75ec1a662
SHA-256: 5565bfd052896264a98a3b3acd778ff83cb6bcb6d224aad73c58fe5659278aea
acroread-plugin-9.4.6-1.el6.i686.rpm
File outdated by:  RHSA-2013:1402
    MD5: c18ce21f3f2789a035b291ba9691428d
SHA-256: 106541dd7b2fb917b10876b3138f03ffed2608f7e0e688c87226aca3bbd16577
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

729497 - CVE-2011-2130 CVE-2011-2134 CVE-2011-2135 CVE-2011-2136 CVE-2011-2137 CVE-2011-2138 CVE-2011-2139 CVE-2011-2140 CVE-2011-2414 CVE-2011-2415 CVE-2011-2416 CVE-2011-2417 CVE-2011-2425 flash-plugin: multiple arbitrary code execution flaws (APSB-11-21)
740201 - CVE-2011-2444 acroread, flash-plugin: Cross-site scripting vulnerability fixed in APSB11-26
740204 - CVE-2011-2429 acroread, flash-plugin: security control bypass information disclosure fixed in APSB11-26
740388 - CVE-2011-2426 CVE-2011-2427 CVE-2011-2428 CVE-2011-2430 acroread, flash-plugin: critical flaws fixed in APSB11-26
749381 - acroread: multiple code execution flaws (APSB11-24)


References

https://www.redhat.com/security/data/cve/CVE-2011-2094.html
https://www.redhat.com/security/data/cve/CVE-2011-2095.html
https://www.redhat.com/security/data/cve/CVE-2011-2096.html
https://www.redhat.com/security/data/cve/CVE-2011-2097.html
https://www.redhat.com/security/data/cve/CVE-2011-2098.html
https://www.redhat.com/security/data/cve/CVE-2011-2099.html
https://www.redhat.com/security/data/cve/CVE-2011-2101.html
https://www.redhat.com/security/data/cve/CVE-2011-2104.html
https://www.redhat.com/security/data/cve/CVE-2011-2105.html
https://www.redhat.com/security/data/cve/CVE-2011-2107.html
https://www.redhat.com/security/data/cve/CVE-2011-2130.html
https://www.redhat.com/security/data/cve/CVE-2011-2134.html
https://www.redhat.com/security/data/cve/CVE-2011-2135.html
https://www.redhat.com/security/data/cve/CVE-2011-2136.html
https://www.redhat.com/security/data/cve/CVE-2011-2137.html
https://www.redhat.com/security/data/cve/CVE-2011-2138.html
https://www.redhat.com/security/data/cve/CVE-2011-2139.html
https://www.redhat.com/security/data/cve/CVE-2011-2140.html
https://www.redhat.com/security/data/cve/CVE-2011-2414.html
https://www.redhat.com/security/data/cve/CVE-2011-2415.html
https://www.redhat.com/security/data/cve/CVE-2011-2416.html
https://www.redhat.com/security/data/cve/CVE-2011-2417.html
https://www.redhat.com/security/data/cve/CVE-2011-2424.html
https://www.redhat.com/security/data/cve/CVE-2011-2425.html
https://www.redhat.com/security/data/cve/CVE-2011-2426.html
https://www.redhat.com/security/data/cve/CVE-2011-2427.html
https://www.redhat.com/security/data/cve/CVE-2011-2428.html
https://www.redhat.com/security/data/cve/CVE-2011-2429.html
https://www.redhat.com/security/data/cve/CVE-2011-2430.html
https://www.redhat.com/security/data/cve/CVE-2011-2431.html
https://www.redhat.com/security/data/cve/CVE-2011-2432.html
https://www.redhat.com/security/data/cve/CVE-2011-2433.html
https://www.redhat.com/security/data/cve/CVE-2011-2434.html
https://www.redhat.com/security/data/cve/CVE-2011-2435.html
https://www.redhat.com/security/data/cve/CVE-2011-2436.html
https://www.redhat.com/security/data/cve/CVE-2011-2437.html
https://www.redhat.com/security/data/cve/CVE-2011-2438.html
https://www.redhat.com/security/data/cve/CVE-2011-2439.html
https://www.redhat.com/security/data/cve/CVE-2011-2440.html
https://www.redhat.com/security/data/cve/CVE-2011-2442.html
https://www.redhat.com/security/data/cve/CVE-2011-2444.html
https://www.redhat.com/security/data/cve/CVE-2011-4374.html
https://access.redhat.com/security/updates/classification/#critical
http://www.adobe.com/support/security/bulletins/apsb11-21.html
http://www.adobe.com/support/security/bulletins/apsb11-24.html
http://www.adobe.com/support/security/bulletins/apsb11-26.html


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/