After a one-week delay, Adobe Systems has released security updates for its Reader and Acrobat products to patch critical vulnerabilities that could lead to computers being compromised.
The new 10.1.12 and 11.0.09 versions of Adobe Reader and Acrobat released Tuesday for Windows and Mac address eight vulnerabilities, five of which could allow for remote code execution.
One of the other three vulnerabilities can be used to bypass the products’ sandbox protection to run code with elevated privileges on Windows, one can lead to a denial-of-service condition and one is a universal cross-site scripting (UXSS) flaw that only affects the programs on the Mac platform.
These security updates were originally planned for Tuesday, Sept. 9, to coincide with Microsoft’s monthly patch release, but Adobe postponed them due to issues identified during testing.
Users are advised to update their installations as soon as possible, as Adobe Reader is widely used and has been targeted by attackers in the past.
“Though these are all high priority issues, the disclosure list suggests that they are not active in the wild, but given the nature of the disclosure, exploit or proof-of-concept code will likely become available in the near future,” said Ross Barrett, senior manager of security engineering at Rapid7, via email.