Adobe releases previously delayed patches for Reader and Acrobat

The updates fix eight vulnerabilities, including some that could be exploited to infect computers with malware

After a one-week delay, Adobe Systems has released security updates for its Reader and Acrobat products to patch critical vulnerabilities that could lead to computers being compromised.

The new 10.1.12 and 11.0.09 versions of Adobe Reader and Acrobat released Tuesday for Windows and Mac address eight vulnerabilities, five of which could allow for remote code execution.

One of the other three vulnerabilities can be used to bypass the products' sandbox protection to run code with elevated privileges on Windows, one can lead to a denial-of-service condition and one is a universal cross-site scripting (UXSS) flaw that only affects the programs on the Mac platform.

These security updates were originally planned for Tuesday, Sept. 9, to coincide with Microsoft's monthly patch release, but Adobe postponed them due to issues identified during testing.

Users are advised to update their installations as soon as possible, as Adobe Reader is widely used and has been targeted by attackers in the past.

"Though these are all high priority issues, the disclosure list suggests that they are not active in the wild, but given the nature of the disclosure, exploit or proof-of-concept code will likely become available in the near future," said Ross Barrett, senior manager of security engineering at Rapid7, via email.

To express your thoughts on Computerworld content, visit Computerworld's Facebook page, LinkedIn page and Twitter stream.
Windows 10 annoyances and solutions
Shop Tech Products at Amazon
Notice to our Readers
We're now using social media to take your comments and feedback. Learn more about this here.