A memory corruption flaw exists in Adobe Reader and Acrobat. The ACE.dll module fails to sanitize user-supplied input when parsing ICC streams, resulting in memory corruption. With a specially crafted file or web page, a context-dependent attacker can overflow a stack buffer and execute arbitrary code.
Classification
Location:
Local / Remote,
Context Dependent
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Solution:
Upgrade
Exploit:
Exploit Private
Disclosure:
Vendor Verified,
Coordinated Disclosure
Solution
Upgrade to version 8.2.5, 9.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
