Multiple vulnerabilities in Adobe Acrobat and Reader
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 18 |
| CVE-ID | CVE-2023-21608 CVE-2023-21614 CVE-2023-21613 CVE-2023-21612 CVE-2023-21611 CVE-2023-21610 CVE-2023-21609 CVE-2023-21607 CVE-2023-21579 CVE-2023-21606 CVE-2023-21605 CVE-2023-21604 CVE-2023-21586 CVE-2023-21585 CVE-2023-21581 CVE-2023-22242 CVE-2023-22240 CVE-2023-22241 |
| CWE-ID | CWE-416 CWE-125 CWE-254 CWE-121 CWE-787 CWE-119 CWE-190 CWE-122 CWE-476 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software Subscribe |
Adobe Acrobat Client/Desktop applications / Office applications Adobe Reader Client/Desktop applications / Office applications |
| Vendor | Adobe |
Security Bulletin
This security bulletin contains information about 18 vulnerabilities.
1) Use-after-free
EUVDB-ID: #VU70893
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21608
CWE-ID:
CWE-416 - Use After Free
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the resetForm method when processing PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-061/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
2) Out-of-bounds read
EUVDB-ID: #VU70885
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2023-21614
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when parsing embedded fonts. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-064/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
3) Out-of-bounds read
EUVDB-ID: #VU70884
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2023-21613
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when parsing embedded fonts. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-065/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
4) Security features bypass
EUVDB-ID: #VU70895
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2023-21612
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to unspecified error when handling PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and bypass implemented security restrictions.
Install updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
5) Security features bypass
EUVDB-ID: #VU70894
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2023-21611
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to unspecified error when handling PDF files. A remote attacker can trick the victim to open a specially crafted PDF file and bypass implemented security restrictions.
Install updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
6) Stack-based buffer overflow
EUVDB-ID: #VU70891
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21610
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing PDF files. A remote unauthenticated attacker can trick the victim to open a specially crafted PDF file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
7) Out-of-bounds write
EUVDB-ID: #VU70890
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21609
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when handling Annotation objects. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-062/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
8) Buffer overflow
EUVDB-ID: #VU70892
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21607
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing embedded fonts. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-066/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
9) Integer overflow
EUVDB-ID: #VU70881
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21579
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow when processing embedded fonts. A remote attacker can trick the victim to open a specially crafted PDF file, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418, 2020.001.30002 - 2020.013.20074
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-058/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
10) Out-of-bounds write
EUVDB-ID: #VU70889
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21606
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing embedded fonts. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-063/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
11) Heap-based buffer overflow
EUVDB-ID: #VU70888
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21605
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when handling embedded fonts. A remote attacker can trick the victim to open a specially crafted PDF file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-060/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
12) Stack-based buffer overflow
EUVDB-ID: #VU70887
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-21604
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing PDF files. A remote unauthenticated attacker can trick the victim to open a specially crafted PDF file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
13) NULL pointer dereference
EUVDB-ID: #VU70886
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2023-21586
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trick the victim to open a specially crafted PDF file and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
14) Out-of-bounds read
EUVDB-ID: #VU70883
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2023-21585
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when parsing embedded fonts. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-059/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
15) Out-of-bounds read
EUVDB-ID: #VU70882
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2023-21581
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when handling embedded fonts. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 22.001.20085 - 22.003.20282, 20.001.30002 - 20.013.20074
Adobe Reader: 22.001.20085 - 22.003.20282, 20.005.30331 - 20.005.30418
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-081/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
16) Out-of-bounds write
EUVDB-ID: #VU72149
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-22242
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error within the handling of Annotation objects. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 20.001.30002 - 20.013.20074, 22.001.20085 - 22.003.20282
Adobe Reader: 20.005.30331 - 20.005.30418, 22.001.20085 - 22.003.20282, 2020.001.30002 - 2020.013.20074
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-108/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
17) Out-of-bounds write
EUVDB-ID: #VU72147
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-22240
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error within the handling of Annotation objects. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 20.001.30002 - 20.013.20074, 22.001.20085 - 22.003.20282
Adobe Reader: 20.005.30331 - 20.005.30418, 22.001.20085 - 22.003.20282
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-110/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
18) Out-of-bounds write
EUVDB-ID: #VU72148
Risk: High
CVSSv3.1:
CVE-ID: CVE-2023-22241
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error within the handling of Annotation objects. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsAdobe Acrobat: 20.001.30002 - 20.013.20074, 22.001.20085 - 22.003.20282
Adobe Reader: 20.005.30331 - 20.005.30418, 22.001.20085 - 22.003.20282, 2020.001.30002 - 2020.013.20074
CPE2.3 External links
http://helpx.adobe.com/security/products/acrobat/apsb23-01.html
http://www.zerodayinitiative.com/advisories/ZDI-23-109/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
