某些 Creative Cloud 应用程序、服务和功能在中国不可用。
Adobe has released security updates for Adobe Acrobat and Reader for Windows and MacOS. These updates address critical vulnerabilities whose successful exploitation could lead to arbitrary code execution in the context of the current user.
Adobe is aware of a report that an exploit for CVE-2018-4990 exists in the wild. Additionally, proof-of-concept code for CVE-2018-4993 has been published and is publicly available.
For more information on Acrobat DC, please visit the Acrobat DC FAQ page.
For more information on Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page.
Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
- Users can update their product installations manually by choosing Help > Check for Updates.
- The products will update automatically, without requiring user intervention, when updates are
detected. - The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.
For IT administrators (managed environments):
- Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
- Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM
(Windows), or on Macintosh, Apple Remote Desktop and SSH.
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
| Product | Track | Updated Versions | Platform | Priority Rating | Availability |
|---|---|---|---|---|---|
| Acrobat DC | Continuous | 2018.011.20040 |
Windows and macOS | 1 | Windows macOS |
| Acrobat Reader DC | Continuous | 2018.011.20040 |
Windows and macOS | 1 | Windows macOS |
| Acrobat 2017 | Classic 2017 | 2017.011.30080 | Windows and macOS | 1 | Windows macOS |
| Acrobat Reader DC 2017 | Classic 2017 | 2017.011.30080 | Windows and macOS | 1 | Windows macOS |
| Acrobat Reader DC (Classic 2015) | Classic 2015 | 2015.006.30418 |
Windows and macOS |
1 | Windows macOS |
| Acrobat DC (Classic 2015) | Classic 2015 | 2015.006.30418 | Windows and macOS | 1 | Windows macOS |
Note:
As noted in this previous announcement, support for Adobe Acrobat 11.x and Adobe Reader 11.x ended on October 15, 2017. Version 11.0.23 is the final release for Adobe Acrobat 11.x and Adobe Reader 11.x. Adobe strongly recommends that you update to the latest versions of Adobe Acrobat DC and Adobe Acrobat Reader DC. By updating installations to the latest versions, you benefit from the latest functional enhancements and improved security measures.
Note:
Please refer to this KB article for more information on mitigating CVE-2018-4993. An additional mitigation for CVE-2018-4993 is available to admins that results in blocking PDF actions that open links, including GoToE, GoToR, Launch, Thread, Import Data, Export Form Data, Submit Form, and Reset Form. For more details, refer to this documentation.
Adobe would like to thank the following individuals and organizations for reporting the
relevant issues and for working with Adobe to help protect our customers:
- Aleksandar Nikolic of Cisco Talos (CVE-2018-4996, CVE-2018-4947, CVE-2018-12812, CVE-2018-12815)
- Anton Cherepanov, ESET and Matt Oh, Microsoft (CVE-2018-4990)
- Vladislav Stolyarov of Kaspersky Lab (CVE-2018-4988, CVE-2018-4987)
- Yoav Alon and Netanel Ben-Simon from Check Point Software Technologies (CVE-2018-4985)
- Gal De Leon of Palo Alto Networks (CVE-2018-4959, CVE-2018-4961)
- Ke Liu of Tencent's Xuanwu Lab (CVE-2018-4949, CVE-2018-4966, CVE-2018-4955, CVE-2018-4951, CVE-2018-4964, CVE-2018-4963, CVE-2018-4960, CVE-2018-4986)
- Anonymously reported via Trend Micro's Zero Day Initiative (CVE-2018-4950, CVE-2018-4951, CVE-2018-4952, CVE-2018-4953, CVE-2018-4954, CVE-2018-4962, CVE-2018-4974)
- WillJ of Tencent PC Manager via Trend Micro's Zero Day Initiative (CVE-2018-4948, CVE-2018-4949, CVE-2018-4955, CVE-2018-4971, CVE-2018-4973)
- Riusksk of Tencent Security Platform Department via Trend Micro's Zero Day Initiative (CVE-2018-4956, CVE-2018-4957)
- Steven Seeley via Trend Micro's Zero Day Initiative (CVE-2018-4949, CVE-2018-4951, CVE-2018-4960, CVE-2018-4963, CVE-2018-4964, CVE-2018-4965, CVE-2018-4966, CVE-2018-4968, CVE-2018-4969)
- Ke Liu of Tencent's Xuanwu LAB working via Trend Micro's Zero Day Initiative (CVE-2018-4967, CVE-2018-4970, CVE-2018-4972, CVE-2018-4975, CVE-2018-4976, CVE-2018-4978, CVE-2018-4981, CVE-2018-4982, CVE-2018-4990)
- Sebastian Apelt siberas via Trend Micro's Zero Day Initiative (CVE-2018-4977)
- AbdulAziz Hariri via Trend Micro's Zero Day Initiative (CVE-2018-4979, CVE-2018-4980, CVE-2018-4984)
- Hui Gao of Palo Alto Networks and Heige (a.k.a. SuperHei) from Knownsec 404 Security Team (CVE-2018-4958, CVE-2018-4983)
- Cybellum Technologies LTD (CVE-2018-4989)
- Alex from Cure53 (CVE-2018-4995)
- Assaf Baharav, Yaron Fruchtmann and Ido Solomon of Check Point Software Technologies (CVE-2018-4993)
May 15, 2018: Added language to notify users that an exploit for CVE-2018-4990 exists in the wild, and that proof-of-concept code for CVE-2018-4985 has been published and is publicly available. Also added CVE-2018-4995 to replace CVE-2018-4994, which was already assigned to an unrelated vulnerability in Adobe Connect. Finally, added CVE-2018-4996 to replace CVE-2018-4946, which was already assigned to an unrelated vulnerability in Adobe Photoshop.
May 16, 2018: Corrected the summary section by replacing CVE-2018-4985 with CVE-2018-4993. Proof-of-concept code is publicly available for CVE-2018-4993, and not CVE-2018-4985.
May 17, 2018: Added a link to documentation that describes an additional mitigation for CVE-2018-4993 that will block users from following links in PDF documents.
May 25, 2018: Modified the track name "Consumer" to "Continuous" to align with previous bulletins.
February 5, 2019: Updated Acknowledgments section