« Volver al listado

CVE-2010-2862

Estado: ModificadaAlta (9.3)—💥 Exploit

Desbordamiento de entero en CoolType.dll de Adobe Reader v8.2.3 y v9.3.3, y Acrobat v9.3.3, permite a atacantes remotos ejecutar código a su elección a través de fuentes TrueType con un valor maxCompositePoints grande en una tabla Maximum Profile (maxp).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (2)

Adobe — AcrobatAdobe — Acrobat Reader

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-2862",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-08-05T18:17:58.087",
  "references": [
    {
      "url": "http://secunia.com/advisories/40766",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "http://securityevaluators.com/files/papers/CrashAnalysis.pdf",
      "source": "psirt@adobe.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-231A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "http://www.zdnet.co.uk/news/security-threats/2010/08/04/adobe-confirms-pdf-security-hole-in-reader-40089737/",
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11693",
      "source": "psirt@adobe.com"
    },
    {
      "url": "http://secunia.com/advisories/40766",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityevaluators.com/files/papers/CrashAnalysis.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-231A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.zdnet.co.uk/news/security-threats/2010/08/04/adobe-confirms-pdf-security-hole-in-reader-40089737/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11693",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-189"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de entero en CoolType.dll de Adobe Reader v8.2.3 y v9.3.3, y Acrobat v9.3.3, permite a atacantes remotos ejecutar código a su elección a través de fuentes TrueType con un valor maxCompositePoints grande en una tabla Maximum Profile (maxp)."
    }
  ],
  "lastModified": "2026-06-16T23:21:38.880",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader:8.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E32D68D5-6A79-454B-B14F-9BC865413E3B"
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader:9.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDC2EEB6-D5EC-430F-962A-1279C9970441"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AB9BBDE-634A-47CF-BA49-67382B547900"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}