Multiple vulnerabilities in Adobe Reader and Acrobat

Published: 2019-10-16 | Updated: 2019-10-16
Severity High
Patch available YES
Number of vulnerabilities 68
CVE ID CVE-2019-8220
CVE-2019-8219
CVE-2019-8217
CVE-2019-8221
CVE-2019-8223
CVE-2019-8225
CVE-2019-8224
CVE-2019-8215
CVE-2019-8214
CVE-2019-8209
CVE-2019-8208
CVE-2019-8203
CVE-2019-8210
CVE-2019-8211
CVE-2019-8213
CVE-2019-8212
CVE-2019-8170
CVE-2019-8183
CVE-2019-8195
CVE-2019-8174
CVE-2019-8200
CVE-2019-8196
CVE-2019-8205
CVE-2019-8186
CVE-2019-8169
CVE-2019-8167
CVE-2019-8166
CVE-2019-8197
CVE-2019-8160
CVE-2019-8162
CVE-2019-8161
CVE-2019-8226
CVE-2019-8192
CVE-2019-8188
CVE-2019-8194
CVE-2019-8193
CVE-2019-8190
CVE-2019-8198
CVE-2019-8201
CVE-2019-8204
CVE-2019-8202
CVE-2019-8163
CVE-2019-8189
CVE-2019-8173
CVE-2019-8172
CVE-2019-8168
CVE-2019-8064
CVE-2019-8182
CVE-2019-8185
CVE-2019-8184
CVE-2019-8207
CVE-2019-8216
CVE-2019-8178
CVE-2019-8177
CVE-2019-8176
CVE-2019-8179
CVE-2019-8180
CVE-2019-8187
CVE-2019-8181
CVE-2019-8175
CVE-2019-8206
CVE-2019-8222
CVE-2019-8218
CVE-2019-8171
CVE-2019-8165
CVE-2019-8199
CVE-2019-8191
CVE-2019-8164
CWE ID CWE-416
CWE-122
CWE-822
CWE-843
CWE-787
CWE-119
CWE-79
CWE-362
CWE-693
CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software Adobe Acrobat Reader DC Subscribe
Adobe Acrobat DC
Vendor Adobe

Security Advisory

1) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8220

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8219

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8217

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8221

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8223

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8225

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8224

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8215

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8214

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8209

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8208

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8203

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8210

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8211

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8213

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8212

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Heap-based buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8170

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Heap-based buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8183

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Untrusted Pointer Dereference

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8195

CWE-ID: CWE-822 - Untrusted Pointer Dereference

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to untrusted pointer dereference when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger untrusted pointer dereference and execute arbitrary code on the system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Untrusted Pointer Dereference

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8174

CWE-ID: CWE-822 - Untrusted Pointer Dereference

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to untrusted pointer dereference when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger untrusted pointer dereference and execute arbitrary code on the system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Type Confusion

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8200

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Untrusted Pointer Dereference

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8196

CWE-ID: CWE-822 - Untrusted Pointer Dereference

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to untrusted pointer dereference when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger untrusted pointer dereference and execute arbitrary code on the system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Untrusted Pointer Dereference

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8205

CWE-ID: CWE-822 - Untrusted Pointer Dereference

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to untrusted pointer dereference when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger untrusted pointer dereference and execute arbitrary code on the system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Out-of-bounds write

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8186

CWE-ID: CWE-787 - Out-of-bounds Write

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Type Confusion

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8169

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Type Confusion

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8167

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Memory corruption

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8166

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Heap-based buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8197

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Cross-site scripting

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8160

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed within the PDF file. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary script code within the application.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Race condition

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8162

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a race condiftion when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Type Confusion

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8161

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Protection Mechanism Failure

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8226

CWE-ID: CWE-693 - Protection Mechanism Failure

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation of built-in security features. A remote attacker can crate a specially crafted PDF file, trick the victim into opening it and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8192

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8188

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8194

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8193

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8190

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8198

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8201

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8204

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8202

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8163

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8189

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8173

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8172

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8168

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8064

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8182

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8185

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8184

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8207

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Out-of-bounds read

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8216

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files#CONDITION1#. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8178

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8177

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8176

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8179

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8180

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8187

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8181

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8175

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can trick the victim into opening a specially crafted PDF file, trigger use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Out-of-bounds write

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-8206

CWE-ID: CWE-787 - Out-of-bounds Write

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.012.20098, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040

CPE