Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2015-3064: Adobe Reader/Acrobat may run unauthorized scripts
CVE-2015-3064 · published 11 years ago
Summary
Versions of Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and macOS can be tricked into executing JavaScript code that should be blocked. This could let an attacker run harmful actions when a user opens a crafted PDF file. Update to the latest version of Adobe Reader or Acrobat to close the gap.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | acrobat |
10.1.0 10.1.1 10.1.2 10.1.3 10.1.4 10.1.5 10.1.6 10.1.7 10.1.8 10.1.9 10.1.10 10.1.11 13 more version ranges
cpe:2.3:a:adobe:acrobat:10.1.0:*:*:*:*:*:*:* |
| apple | mac_os_x |
All versions
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* |
| microsoft | windows |
All versions
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* |
| adobe | acrobat_reader |
10.1.0 10.1.1 10.1.2 10.1.3 10.1.4 10.1.5 10.1.6 10.1.7 10.1.8 10.1.9 10.1.10 10.1.11 13 more version ranges
cpe:2.3:a:adobe:acrobat_reader:10.1.0:*:*:*:*:*:*:* |
Original advisory text
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a diffe...
Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
References
- http://www.securityfocus.com/bid/74604 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1032284 Third Party Advisory VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-15-204 Third Party Advisory VDB Entry
- https://helpx.adobe.com/security/products/reader/apsb15-10.html Patch Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
10.0
Critical
Type
CWE-284Improper Access Control
Timeline
Published13 May 2015
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-3064 · NVD
Track software like this
Free during beta