Multiple vulnerabilities in Adobe Reader and Acrobat



Published: 2018-09-19 | Updated: 2019-01-29
Risk High
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2018-12801
CVE-2018-12840
CVE-2018-12778
CVE-2018-12775
CVE-2018-12850
CVE-2018-12849
CVE-2018-12848
CVE-2018-19723
CWE-ID CWE-125
CWE-119
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #5 is available.
Public exploit code for vulnerability #6 is available.
Public exploit code for vulnerability #7 is available.
Vulnerable software
Subscribe 		Adobe Reader
Client/Desktop applications / Office applications

Adobe Acrobat
Client/Desktop applications / Office applications

Vendor Adobe

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU14806

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-12801

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Out-of-bounds read

EUVDB-ID: #VU14807

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-12840

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Out-of-bounds read

EUVDB-ID: #VU14808

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-12778

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Out-of-bounds read

EUVDB-ID: #VU14809

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-12775

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Out-of-bounds read

EUVDB-ID: #VU14805

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-12850

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Out-of-bounds read

EUVDB-ID: #VU14804

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-12849

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Buffer overflow

EUVDB-ID: #VU14803

Risk: High

CVSSv3.1:

CVE-ID: CVE-2018-12848

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Out-of-bounds read

EUVDB-ID: #VU17251

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-19723

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger out-of-bounds read and read memory contents.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Reader: 2015.006.30306 - 2018.011.20058

Adobe Acrobat: 15.006.30306 - 18.011.20058

Fixed software versions

CPE2.3 External links

http://helpx.adobe.com/security/products/acrobat/apsb18-34.html


Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###