CVE-2013-0641 : Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6

Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

Published 2013-02-14 01:55:02

Updated 2024-07-16 17:36:06

Source Adobe Systems Incorporated

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2013-0641

Redhat » Enterprise Linux Desktop » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 5.9
cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 6.4
cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 6.4
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 5.9
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*
Matching versions
Adobe » Acrobat Reader
Versions from including (>=) 11.0 and before (<) 11.0.02
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Adobe » Acrobat Reader
Versions from including (>=) 9.0 and before (<) 9.5.4
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
Adobe » Acrobat Reader
Versions from including (>=) 10.0 and before (<) 10.1.6
cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Adobe » Acrobat
Versions from including (>=) 9.0 and before (<) 9.5.4
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Adobe » Acrobat
Versions from including (>=) 10.0 and before (<) 10.1.6
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Adobe » Acrobat
Versions from including (>=) 11.0 and before (<) 11.0.02
cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Suse » Linux Enterprise Desktop » Version: 11 Update SP2
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise Desktop » Version: 10 Update SP4
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*
Matching versions
Opensuse » Opensuse » Version: 11.4
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 12.1
cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
Matching versions

CVE-2013-0641 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Adobe Reader Buffer Overflow Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2013-0641

Added on 2022-03-03 Action due date 2022-03-24

Exploit prediction scoring system (EPSS) score for CVE-2013-0641

EPSS FAQ

77.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-0641

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST	2024-07-16
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2013-0641

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-0641

http://www.adobe.com/support/security/bulletins/apsb13-07.html

Adobe - Security Bulletins: APSB13-07 - Security updates for Adobe Reader and Acrobat
Broken Link

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00021.html

[security-announce] openSUSE-SU-2013:0335-1: critical: acroread to 9.5.4
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00024.html

[security-announce] SUSE-SU-2013:0349-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html

Adobe Product Security Incident Response Team (PSIRT) Blog
Broken Link;Vendor Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2013-0551.html

RHSA-2013:0551 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html

FireEye Blog - Threat Research and Analysis | FireEye
Broken Link

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16296

Repository / Oval Repository
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00023.html

[security-announce] openSUSE-SU-2013:0342-1: critical: acroread to 9.5.4
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.kb.cert.org/vuls/id/422807

VU#422807 - Adobe Reader and Acrobat memory corruption vulnerabilities
Third Party Advisory;US Government Resource

CVEs referencing this url
http://security.gentoo.org/glsa/glsa-201308-03.xml

Adobe Reader: Multiple vulnerabilities (GLSA 201308-03) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://www.adobe.com/support/security/advisories/apsa13-02.html

Adobe - Security Advisories: APSA13-02 - Security Advisory for Adobe Reader and Acrobat
Vendor Advisory

CVEs referencing this url
http://blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploit

Digging Into the Sandbox-Escape Technique of the Recent PDF Exploit | McAfee Blogs
Broken Link