# CERT-FR established; PDF and Java hardening guidance

Published: 2014-01-24 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/ad62eade-96e5-59f8-b963-51a4c7b821cb/cert-fr-established-pdf-and-java-hardening-guidance

> French government CERT-FR replaces CERTA; advisory covers PDF exploitation risks with 153 Adobe Reader CVEs and Java 7 Update 51 security policy changes.

The French government announced the renaming of CERTA to CERT-FR on 21 January 2014, establishing the official Computer Emergency Response Team for France. The bulletin addresses two significant security topics affecting defenders.

The first major topic covers PDF format risks. PDFs are heavily exploited due to their ubiquity (99% of endpoints have a PDF reader) and the complex attack surface offered by Adobe Reader's functionality including AcroForm handling, JavaScript execution, embedded file support, and Flash rendering. The article cites 153 Adobe Reader vulnerabilities over three years and provides two specific examples: CVE-2013-0640 (affecting Reader 9.x, 10.x, 11.x through heap spray attacks on AcroForm objects, actively exploited in targeted campaigns) and CVE-2012-0754 (affecting Reader 10.x, 11.x on Android through malformed MP4 video objects, documented in targeted attacks). CERT-FR recommends disabling non-PDF attachment opening, JavaScript, and enabling enhanced protection mode with logging.

The second topic is Java SE 7 Update 51 released 14 January 2014, which raises the default security policy to "high" level. This mandates that applets be signed by recognized certificate authorities and requires a MANIFEST.MF file with Permissions and Codebase attributes; unsigned or self-signed applets will be blocked. Legacy applets lacking proper manifests may break and require updates before deployment.

## Mentioned in this report

- Vulnerabilities: CVE-2012-0754 (KEV), CVE-2013-0640 (KEV)

Source reporting: https://www.cert.ssi.gouv.fr/actualite/CERTFR-2014-ACT-004

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ad62eade-96e5-59f8-b963-51a4c7b821cb/cert-fr-established-pdf-and-java-hardening-guidance.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup