Adobe’s first round of security updates for 2019 resolve two critical vulnerabilities in the company’s Acrobat and Reader products, but administrators should not be too concerned about the flaws being exploited in the wild any time soon.
The latest versions of Acrobat DC, Acrobat Reader DC, Acrobat 2017 and Acrobat Reader DC 2017 for Windows and macOS patch a use-after-free bug that can lead to arbitrary code execution in the context of the current user (CVE-2018-16011), and a security bypass issue that can result in privilege escalation (CVE-2018-19725).
The first vulnerability was discovered by Sebastian Apelt and the second by Abdul Aziz Hariri. Both security holes were reported to Adobe via Trend Micro’s Zero Day Initiative (ZDI).
While both flaws are considered critical, Adobe has assigned them a priority rating of 2, which means exploits are not imminent and administrators are advised to install the patches within 30 days.
Adobe patched hundreds of vulnerabilities in Acrobat products last year, including one that it failed to fix properly on the first try and a zero-day flaw exploited by malicious actors for arbitrary code execution.
Related: Over 100 Vulnerabilities Patched in Adobe Acrobat, Reader
Related: Adobe Patches Code Execution, Other Flaws in Acrobat and Reader
Related: Adobe Patches 86 Vulnerabilities in Acrobat Products
