Google warns of using Adobe Reader - particularly on Linux

By +Frank B.
in Back Page News

 Share

Recommended Posts

Grand Master

+Frank B. Subscriber²

Posted
  • Subscriber²
Posted

Google warns of using Adobe Reader - particularly on Linux

On its August Patch Day, Adobe has fixed numerous critical memory-related bugs in Reader for Windows and Mac OS X ? but has chosen to overlook Linux users. The researchers who discovered the holes now fear that potential attackers could find enough clues to build an exploit by comparing the current Windows version of Reader with the previous one. This would leave Linux users defenceless. On top of that, even the patched versions still contain a total of 16 open security holes.

Google employees Mateusz Jurczyk and Gynvael Coldwind initially examined the PDF engine of the Chrome browser and discovered numerous holes. They then tested Adobe Reader and found about 60 issues that triggered crashes, 40 of which are potential attack vectors. When the two researchers reported their discoveries to Adobe, the company promised to provide fixes ? but also indicated that not all the holes would be closed on Patch Day in August.

On Tuesday, that is exactly what happened. Versions 10.1.4 and 9.5.2 were released for Windows and Mac OS X only. Even these patched versions are still vulnerable to 16 of the reported issues that affect Windows, Mac OS X or both systems. To prove this, the Google employees have released obfuscated information concerning the crashes. The security experts say that the unpatched holes could potentially be identified by third parties because they were found by modifying publicly available PDF documents.

Apparently, the researchers' threat to publish all vulnerability details online in accordance with "responsible disclosure" did not worry Adobe. The deadline is set for 60 days after the day on which the researchers informed Adobe about the holes: 27 August. However, Adobe told the researchers that no further updates are planned in that timeframe.

The Google employees therefore recommend that users refrain from opening any PDF documents from external sources in Adobe Reader. Those who use a browser other than Chrome can protect themselves by disabling the Reader's browser extension. The extension allows the holes to be exploited with a simple visit to a specially crafted web page.

Windows users who still use version 9 of Reader have been advised to upgrade to Adobe Reader X, because this version contains a sandbox that makes exploiting the holes more difficult. While Linux users can fix two of the holes by deleting the annots.api and PPKLite.api plug-ins from the /path/to/Adobe/Reader9/Reader/intellinux/plug_ins directory, this seems like a drop in the ocean when considering the total number of holes that riddle Reader for Linux.

Source: The H Online

Veteran

The Dark Knight

Posted
Posted

I stopped using that bug ridden bloatware on all platforms a long time ago.

What do you use instead? I am also looking for a good replacement.

Grand Master

Noir Angel

Posted
Posted

I use Foxit on Windows, haven't used Adobe reader for about 3 years. It's bloated, slow, and now apparently insecure. And I didn't know the PDF plugin in Chrome was made by Adobe, how do I disable it?

This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • Hi my name is Olivia and I am from Australia

      By cleverclogs · Posted

      Hello mysterious lamborghiniv10, I was in Australia and... now I'm in the Netherlands. 
    • EU says Meta must restore rival chatbots' access to WhatsApp

      By Hamid Ganji · Posted

      EU says Meta must restore rival chatbots' access to WhatsApp by Hamid Ganji The European Commission has ordered Meta to restore third-party AI chatbots’ access to WhatsApp after the tech giant decided to block them from operating on the popular messaging platform. After Meta banned rival AI chatbots from operating on WhatsApp, the European Commission launched an antitrust investigation to determine whether the company had abused its market dominance. As a result of Meta’s decision, third-party AI chatbots, including Microsoft’s Copilot and OpenAI’s ChatGPT, were prevented from operating on WhatsApp. At the time, Meta said it wanted to reserve the WhatsApp Business API for other types of businesses and did not allow rival chatbots to use it. This effectively prevented the WhatsApp ecosystem from being used to distribute rival chatbot services. However, the European Commission has now announced an interim measures decision requiring Meta to restore access to WhatsApp for rival general-purpose AI assistants on the same terms and conditions as before October 15, 2025. The Commission has also asked Meta to maintain that access until the antitrust investigation is concluded. The Commission argues that Meta has used its dominant market position to prevent rival AI chatbots from accessing the WhatsApp Business API. While Meta allowed rival services to return to WhatsApp by paying a fee, the European Commission still considers that arrangement to be a de facto access ban. According to EU antitrust chief Teresa Ribera, the fees introduced by Meta are so high that using WhatsApp is no longer economically sustainable for competitors. “It seems that Meta expects to leverage the vast reach and likely dominance of WhatsApp to benefit its own AI assistant and to foreclose rivals,” Ribera said. “We cannot let large digital incumbents leverage their dominance of the past to dictate who in Europe gets to compete and who gets to innovate in AI.”
    • Save 31% on Samsung T7 Portable SSD

      By +Warwagon · Posted

      A few years ago walmart had the 512 models on clearance for $35. I bought 3 of them. I should have purchased more.
    • Should Microsoft be forced to stop promoting Edge over other browsers?

      By +virtorio · Posted

      I'm fine with a little reasonable promotion of Edge, but the degree which they do it right now I consider extremely unreasonable. 
    • Microsoft AI boss no longer believes that AI will replace human workers

      By David Uzondu · Posted

      Microsoft AI boss no longer believes that AI will replace human workers by David Uzondu Mustafa Suleyman, the head of Microsoft AI, recently took back his statements concerning white-collar jobs that he gave to the Financial Times in an interview made back in February, where he claimed that AI would replace office workers within 12 to 18 months. On Monday's episode of The Verge's Decoder, Suleyman recast the technology as more like a helpmate than a tool designed to take over your job. He explained that smaller office duties will "increasingly become digitized, automated" as people generate more digital materials. During the discussion, Suleyman emphasized a "very important distinction" between "tasks" and "jobs" to clarify his previous claims. He argued that his earlier comments only referred to individual actions that people perform at their desks. Suleyman used to work for DeepMind, the research lab he co-founded in 2010 alongside Demis Hassabis and Shane Legg, before he left in 2022 to establish Inflection AI and build an empathetic digital assistant. Microsoft hired him in March 2024 to lead its newly formed "Microsoft AI" division, placing him in charge of consumer products like Copilot, Bing, and Edge. His February comments also detailed plans for Microsoft to achieve self-sufficiency with a $140 billion infrastructure budget to train frontier models, predicting that creating a customized AI will soon feel like creating a podcast or a new blog: The 41-year-old is not the only AI executive who's softened his "AI will replace you" stance. OpenAI's CEO, Sam Altman, last month used X to push back against employment panic by arguing that his startup builds tools to assist humans rather than build replacements. He had previously garnered backlash by suggesting that many modern office roles that AI might replace did not qualify as "real work" in the first place, at least when you compare desk jobs to physical, historical labor like farming.

  • Recent Achievements

    • One Year In
      Primer1st earned a badge
      One Year In
    • Experienced
      JayZJay went up a rank
      Experienced
    • Reacting Well
      Sir_Timbit earned a badge
      Reacting Well
    • Week One Done
      rubentuben8 earned a badge
      Week One Done
    • Week One Done
      ARaclen earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      512
    2. 2
      PsYcHoKiLLa
      229
    3. 3
      Edouard
      134
    4. 4
      ATLien_0
      87
    5. 5
      Steven P.
      80
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!