Adobe fixes "critical" bugs in Reader, Acrobat and RoboHelp publishing tool

Share this article:

Adobe has released security updates for its popular Reader and Acrobat products for Windows users.

The fixes, released Tuesday, addressed a “critical” vulnerability, CVE-2013-5325, resolving a “regression” that permitted the launch of javascript scheme uniform resource identifiers (URIs) while users viewed a PDF in their web browser, an Adobe security bulletin said.

With the updates, a critical flaw, CVE-2013-5327, in Adobe publishing tool RoboHelp 10 for Windows users was also addressed. A memory corruption bug that could allow a saboteur to execute malicious code was fixed with the patch.

Paul Ducklin, a security researcher who writes for Sophos' Naked Security blog, said that users worried about implementing the patch due to hackers' theft of Adobe source code should still apply the Reader and Acrobat updates as it's doubtful that software modifications would be able to slip by the company unnoticed.

“My own opinion is that this is highly unlikely, not least because modern software engineering tools make it comparatively easy to track the changes to the source code files in a product between builds,” Ducklin wrote. “Also, remember that this patch deals with fixing a regression – 'repatching' a previous patch – rather than with a shepherding in [of] a huge raft of changes throughout the product.”

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

President signs Executive Order to improve payment security

President signs Executive Order to improve payment security

President Obama signed an Executive Order at the Consumer Financial Protection Bureau calling for enhanced security measures, including microchips and PINs.

Security, tech firm coalition fights Hikit actors, other advanced groups

Security, tech firm coalition fights Hikit actors, other ...

The coalition began as an effort to stop the spread of the Hikit trojan, previously known for targeting U.S. defense contractors.

Phishing email delivers keylogger malware, also takes screenshots

Phishing email delivers keylogger malware, also takes screenshots

The malware has various features, including the ability to start persistently, take screenshots and bypass user access controls.