Multiple vulnerabilities in Adobe Acrobat and Reader

1) Untrusted Pointer Dereference

EUVDB-ID: #VU23524

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16446

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

2) Buffer overflow

EUVDB-ID: #VU23523

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16462

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF content. A remote attacker can create a specially crafted PDF file, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

3) Heap-based buffer overflow

EUVDB-ID: #VU23522

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16451

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF content. A remote attacker can create a specially crafted PDF file, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

4) Use-after-free

EUVDB-ID: #VU23521

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16464

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

5) Untrusted Pointer Dereference

EUVDB-ID: #VU23525

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16455

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

6) Untrusted Pointer Dereference

EUVDB-ID: #VU23526

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16460

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

7) Security restrictions bypass

EUVDB-ID: #VU23529

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16453

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to unspecified error, related to implemented security restrictions. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

8) Insecure DLL loading

EUVDB-ID: #VU23528

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-16444

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

9) Untrusted Pointer Dereference

EUVDB-ID: #VU23527

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16463

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to untrusted pointer dereference when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

10) Use-after-free

EUVDB-ID: #VU23520

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16459

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

11) Use-after-free

EUVDB-ID: #VU23519

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16452

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

12) Out-of-bounds read

EUVDB-ID: #VU23513

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16461

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

13) Out-of-bounds read

EUVDB-ID: #VU23512

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16458

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

14) Out-of-bounds read

EUVDB-ID: #VU23511

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16457

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

15) Out-of-bounds read

EUVDB-ID: #VU23510

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16456

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

16) Out-of-bounds read

EUVDB-ID: #VU23514

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16465

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

17) Out-of-bounds write

EUVDB-ID: #VU23515

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16450

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

18) Use-after-free

EUVDB-ID: #VU23518

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16448

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

19) Use-after-free

EUVDB-ID: #VU23517

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16445

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

20) Out-of-bounds write

EUVDB-ID: #VU23516

Risk: High

CVSSv3.1:

CVE-ID: CVE-2019-16454

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?

21) Out-of-bounds read

EUVDB-ID: #VU23509

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-16449

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat: 15.006.30503 - 19.021.20056

Adobe Reader: 2015.006.30505 - 2019.021.20056

Fixed software versions

CPE2.3

• cpe:2.3:a:adobe:adobe_acrobat:19.021.20056:*:*:*:*:*:*:*

External links

http://helpx.adobe.com/security/products/acrobat/apsb19-55.html

Q & A

Can this vulnerability be exploited remotely?

How the attacker can exploit this vulnerability?

Is there known malware, which exploits this vulnerability?