Google warns of using Adobe Reader - particularly on Linux

By +Frank B.
in Back Page News

 Share

Recommended Posts

Grand Master

+Frank B. Subscriber²

Posted
  • Subscriber²
Posted

Google warns of using Adobe Reader - particularly on Linux

On its August Patch Day, Adobe has fixed numerous critical memory-related bugs in Reader for Windows and Mac OS X ? but has chosen to overlook Linux users. The researchers who discovered the holes now fear that potential attackers could find enough clues to build an exploit by comparing the current Windows version of Reader with the previous one. This would leave Linux users defenceless. On top of that, even the patched versions still contain a total of 16 open security holes.

Google employees Mateusz Jurczyk and Gynvael Coldwind initially examined the PDF engine of the Chrome browser and discovered numerous holes. They then tested Adobe Reader and found about 60 issues that triggered crashes, 40 of which are potential attack vectors. When the two researchers reported their discoveries to Adobe, the company promised to provide fixes ? but also indicated that not all the holes would be closed on Patch Day in August.

On Tuesday, that is exactly what happened. Versions 10.1.4 and 9.5.2 were released for Windows and Mac OS X only. Even these patched versions are still vulnerable to 16 of the reported issues that affect Windows, Mac OS X or both systems. To prove this, the Google employees have released obfuscated information concerning the crashes. The security experts say that the unpatched holes could potentially be identified by third parties because they were found by modifying publicly available PDF documents.

Apparently, the researchers' threat to publish all vulnerability details online in accordance with "responsible disclosure" did not worry Adobe. The deadline is set for 60 days after the day on which the researchers informed Adobe about the holes: 27 August. However, Adobe told the researchers that no further updates are planned in that timeframe.

The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader. Those who use a browser other than Chrome can protect themselves by disabling the Reader's browser extension. The extension allows the holes to be exploited with a simple visit to a specially crafted web page.

Windows users who still use version 9 of Reader have been advised to upgrade to Adobe Reader X, because this version contains a sandbox that makes exploiting the holes more difficult. While Linux users can fix two of the holes by deleting the annots.api and PPKLite.api plug-ins from the /path/to/Adobe/Reader9/Reader/intellinux/plug_ins directory, this seems like a drop in the ocean when considering the total number of holes that riddle Reader for Linux.

Source: The H Online

Veteran

The Dark Knight

Posted
Posted

I stopped using that bug ridden bloatware on all platforms a long time ago.

What do you use instead? I am also looking for a good replacement.

Grand Master

Noir Angel

Posted
Posted

I use Foxit on Windows, haven't used Adobe reader for about 3 years. It's bloated, slow, and now apparently insecure. And I didn't know the PDF plugin in Chrome was made by Adobe, how do I disable it?

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • TeamViewer 15.78.4.0

      By Accuphase · Posted

      "TeamViewer is the fast, simple and friendly solution for remote access over the Internet" Regarding the "friendly" description, has is stopped unceremoniusly booting your session after a couple of minutes accusing you of using it in a commercial environment?!
    • U.S. delegation throws away all burner phones and gifts from China before takeoff

      By AsherGZ · Posted

      I hate religious supremacist genocidal maniacs. How antisemitic of you to imply that's what all Jews are like. Still no links I see. I guess when you're a zionists, backing your claims with proof doesn't matter. bEliEvE mE oR yOuRe hItLeR.
    • Phone Dilemma

      By +virtorio · Posted

      Moto G Stylus has better specs and a stylus. Search for the specs to see if they they're important to you. 
    • Microsoft is bringing big performance improvements to OneDrive on Mac

      By +pmrd · Posted

      Funny how people who don't use OneDrive feel the need to give their opinion.
    • Win11Debloat 06.10.2026

      By Copernic · Posted

      Win11Debloat 06.10.2026 by Razvan Serea Win11Debloat is a lightweight, easy to use PowerShell script that allows you to quickly declutter and customize your Windows experience. It can remove pre-installed bloatware apps, disable telemetry, remove intrusive interface elements and much more. The script also includes many features that system administrators and power users will enjoy. Such as a powerful command-line interface, support for Windows Audit mode and the option to make changes to other Windows users. All changes made by Win11Debloat can be easily reversed, and most removed apps can be restored via the Microsoft Store. A full guide on how to undo the changes is available here. Win11Debloat features: Below is an overview of the key features and functionality offered by Win11Debloat. Please refer to the wiki for more information about the default settings preset. Remove a wide variety of preinstalled apps. Click here for more info. Disable telemetry, diagnostic data, activity history, app-launch tracking & targeted ads. Disable tips, tricks, suggestions & ads across Windows. Disable Windows location services & app location access. Disable Find My Device location tracking. Disable 'Windows Spotlight' and tips & tricks on the lock screen. Disable 'Windows Spotlight' desktop background option. Disable ads, suggestions and the MSN news feed in Microsoft Edge. Hide Microsoft 365 ads on the Settings 'Home' page, or hide the 'Home' page entirely. Disable & remove Microsoft Copilot. Disable Windows Recall. Disable Click to Do, AI text & image analysis tool. Prevent AI service (WSAIFabricSvc) from starting automatically. Disable AI Features in Edge. Disable AI Features in Paint. Disable AI Features in Notepad. Disable the Drag Tray for sharing & moving files. Restore the old Windows 10 style context menu. Turn off Enhance Pointer Precision, also known as mouse acceleration. Disable the Sticky Keys keyboard shortcut. Disable Storage Sense automatic disk cleanup. Disable fast start-up to ensure a full shutdown. ...and more. Once you’ve downloaded the Win11Debloat file (Get.ps1), just follow these quick steps: Locate the Get.ps1 script file. Right-click the file and select Run with PowerShell from the context menu. If prompted by User Account Control (UAC), select Yes to grant the script the necessary administrative permissions. Win11Debloat 06.10.2026 release notes: This release brings some long-requested features alongside a host of fixes. For starters, Win11Debloat can now automatically detect previously applied tweaks for the logged-in user. And reverting them is as simple as unchecking the corresponding setting. The script now also fully supports running under the SYSTEM account, which has also made it possible to apply changes to users who are still logged in. This makes it far easier to integrate Win11Debloat into your automations and deployments. What's changed: Add confirmation dialogs & warning for Windows Terminal Removal by @Raphire Add Support for running the script under SYSTEM account by @soccerzockt in #609 With this, support was also added for applying changes to users that are still logged-in. Add option to show & undo previously applied tweaks by @Raphire in #599 Add additional options to change the All Apps view in the start menu (Hide, Grid, Category, List) by @Raphire in #599 Clean up logging of exceptions during Appx Package uninstallation via Write-Verbose by @HetCreep in #617 Improve log output in Get.ps1/Get-Dev.ps1 and clean up file exclusions by @Raphire Remove RemoveCommApps and RemoveW11Outlook app removal parameters. Use -RemoveApps parameter instead by @Raphire in #599 Resolve nested quoting bug in Run.bat when path has spaces, see #583 by @Raphire in #599 Fix desync issue when toggling "Only Show Installed" checkbox too fast by @Raphire in #599 Fix: add missing keys in Sysprep/Undo regfiles for Disabling Recall and Windows Suggested content by @Raphire in #599 Fix 'Disable Animations' Sysprep settings not being set for new users by @Raphire in #599 Fix typo in Disable_Game_Bar_Integration Sysprep registry file by @Raphire Note The -RemoveCommApps and -RemoveW11Outlook command-line parameters for uninstalling a few specific apps have been removed with this release. If you previously relied on these parameters, please see this wiki page for alternative methods of removing these apps. Download: Win11Debloat 06.10.2026 | Open Source View: Win11Debloat Home Page | Screenshots 1| 2 Get alerted to all of our Software updates on Twitter at @NeowinSoftware

  • Recent Achievements

    • One Month Later
      Sopa flores earned a badge
      One Month Later
    • First Post
      StaticMatrix earned a badge
      First Post
    • Week One Done
      StaticMatrix earned a badge
      Week One Done
    • Rookie
      lamborghiniv10 went up a rank
      Rookie
    • One Month Later
      pinnclepd earned a badge
      One Month Later

  • Popular Contributors

    1. 1
      +primortal
      508
    2. 2
      PsYcHoKiLLa
      207
    3. 3
      +Edouard
      156
    4. 4
      Steven P.
      89
    5. 5
      ATLien_0
      79
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!