Multiple vulnerabilities in Adobe Reader and Acrobat



Published: 2021-02-10 | Updated: 2021-06-24
Risk Critical
Patch available YES
Number of vulnerabilities 26
CVE ID CVE-2021-21062
CVE-2021-21021
CVE-2021-21028
CVE-2021-21033
CVE-2021-21035
CVE-2021-21039
CVE-2021-21040
CVE-2021-21041
CVE-2021-21060
CVE-2021-21057
CVE-2021-21063
CVE-2021-21059
CVE-2021-21017
CVE-2021-21058
CVE-2021-21038
CVE-2021-21044
CVE-2021-21061
CVE-2021-21034
CVE-2021-21042
CVE-2021-21045
CVE-2021-21036
CVE-2021-21037
CVE-2021-21046
CVE-2021-21086
CVE-2021-21088
CVE-2021-21089
CWE ID CWE-119
CWE-416
CWE-20
CWE-476
CWE-122
CWE-787
CWE-125
CWE-284
CWE-190
CWE-22
Exploitation vector Network
Public exploit Vulnerability #13 is being exploited in the wild.
Public exploit code for vulnerability #19 is available.
Vulnerable software
Subscribe
Adobe Acrobat DC
Client/Desktop applications / Office applications

Adobe Acrobat Reader DC
Client/Desktop applications / Office applications

Adobe Acrobat
Client/Desktop applications / Office applications

Adobe Acrobat Reader
Client/Desktop applications / Office applications

Vendor Adobe

Security Advisory

Updated: 18.03.2021

Added vulnerabilities #24-26.

Updated: 11.05.2021

Changed information about affected versions and added link to another Adobe bulletin for vulnerabilities #15,16 and 24.

1) Memory corruption

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21062

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21021

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21028

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21033

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21035

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21039

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21040

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21041

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper input validation

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21060

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) NULL pointer dereference

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21057

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a NULL pointer dereference error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a NULL pointer dereference error and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory corruption

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21063

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Memory corruption

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21059

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Heap-based buffer overflow

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21017

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDf file, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

14) Memory corruption

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21058

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds write

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21038

CWE-ID: CWE-787 - Out-of-bounds Write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.001.30020, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.001.30020, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018, 2020.001.30020

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2020.001.30005, 2020.001.30010, 2020.001.30018, 2020.001.30020

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
https://helpx.adobe.com/security/products/acrobat/apsb21-29.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds write

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21044

CWE-ID: CWE-787 - Out-of-bounds Write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.001.30020, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.001.30020, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018, 2020.001.30020

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2020.001.30005, 2020.001.30010, 2020.001.30018, 2020.001.30020

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
https://helpx.adobe.com/security/products/acrobat/apsb21-29.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Use-after-free

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21061

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a use-after-free error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Out-of-bounds read

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21034

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Out-of-bounds read

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21042

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

20) Improper access control

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21045

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Integer overflow

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21036

CWE-ID: CWE-190 - Integer Overflow or Wraparound

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Path traversal

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21037

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and overwrite arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Buffer overflow

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21046

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, trigger memory corruption and crash the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Out-of-bounds write

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21086

CWE-ID: CWE-787 - Out-of-bounds Write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a buffer overflow and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.001.30020, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.001.30020, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018, 2020.001.30020

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2020.001.30005, 2020.001.30010, 2020.001.30018, 2020.001.30020

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
https://helpx.adobe.com/security/products/acrobat/apsb21-29.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21088

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the colorConvertPage method when processing PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
https://www.zerodayinitiative.com/advisories/ZDI-21-335/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Out-of-bounds read

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2021-21089

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the handling of URIs by weblink.api. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Adobe Acrobat DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30495, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.010.20100, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat Reader DC: 2015.006.30306, 2015.006.30355, 2015.006.30392, 2015.006.30394, 2015.006.30413, 2015.006.30417, 2015.006.30418, 2015.006.30434, 2015.006.30448, 2015.006.30452, 2015.006.30456, 2015.006.30457, 2015.006.30461, 2015.006.30464, 2015.006.30475, 2015.006.30482, 2015.006.30497, 2015.006.30498, 2015.006.30499, 2015.006.30503, 2015.006.30504, 2017.009.20044, 2017.009.20058, 2017.011.30079, 2017.011.30080, 2017.011.30096, 2017.011.30099, 2017.011.30105, 2017.011.30106, 2017.011.30110, 2017.011.30113, 2017.011.30120, 2017.011.30127, 2017.011.30142, 2017.011.30143, 2017.011.30144, 2017.011.30148, 2017.011.30150, 2017.012.20098, 2018.009.20044, 2018.009.20050, 2018.011.20035, 2018.011.20038, 2018.011.20040, 2018.011.20055, 2018.011.20058, 2018.011.20063, 2019.008.20071, 2019.008.20080, 2019.008.20081, 2019.010.20064, 2019.010.20069, 2019.010.20091, 2019.010.20098, 2019.012.20034, 2019.012.20035, 2019.012.20036, 2019.012.20040, 2019.021.20047, 2019.021.20056, 2019.021.20058, 2019.021.20061, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074

Adobe Acrobat: 2015.006.30503, 2015.006.30504, 2015.006.30505, 2015.006.30508, 2015.006.30510, 2015.006.30518, 2015.006.30523, 2015.006.30527, 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2020.001.30002, 2020.001.30005, 2020.001.30010, 2020.001.30018

Adobe Acrobat Reader: 2015.006.30508, 2015.006.30510, 2015.006.30523, 2017.011.30156, 2017.011.30158, 2017.011.30171, 2017.011.30180, 2017.011.30188, 2020.001.30005, 2020.001.30010, 2020.001.30018

CPE External links

https://helpx.adobe.com/security/products/acrobat/apsb21-09.html
https://www.zerodayinitiative.com/advisories/ZDI-21-336/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open an attachment in an e-mail message.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###