Security researcher casually drops Adobe Reader, Windows critical vulnerability bomb

[Venustus]

A security researcher has casually revealed 15 vulnerabilities which impact on Microsoft Windows and Adobe Reader.

On Tuesday, Google Project Zero hacker Mateusz Jurczyk outlined a total of 15 critical vulnerabilities discovered within font management systems.

The research, also presented at the REcon security conference in Montreal in a talk called "One font vulnerability to rule them all: A story of cross-software ownage, shared codebases and advanced exploitation," (.PDF), reveals a set of nasty remote code execution and privilege escalation flaws which can be exploited through Adobe Reader or the Windows Kernel.

Jurczyk discovered a number of low to critical-severity security flaws, but the worst two,CVE-2015-3052 and CVE-2015-0093, which exist in both 32-bit and 64-bit systems, are found within the Adobe Type Manager Font Driver.

Further reading

 

[Rolo]

OK EVERYONE BACK TO RASTER FONTS. FIXEDSYS FTW!

Note how the sandboxes were ineffective...

 

[LabZero]

Well , about Windows , between an update and the other, sometimes. . . . I can also work , but despite this is clearly not enough.

Adobe instead should think more security than filling of unnecessary features its software .

 

[jamescv7]

Well the thing must consider until now is that Adobe still complies a widely audience of selection therefore vulnerabilities have more exist, plus money can generate a lot compares to others.

Flip of events may occur if PDF alternatives are dramatically well use by majority, which makes Adobe lessen the possible target attacks.

-------------

That's the reason for browsers where GC become most targeted vulnerability attacks even its been performed the patches immediately and IE is follow to be 3rd place or near to least vulnerable.

 

[Rolo]

Security first? Definitely not...stifles innovation and capability.