Adobe Adobe Acrobat and Reader
At a glance
- Source
- NVD
- EPSS
- EPSS 3.55 % · percentile 89 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
Weaknesses (CWE)
- CWE-416 — Use After Free
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-25014
- GCVE · GCVE-0-2020-3748
CERT-FR advisories
- CERTFR-2020-AVI-076 — Multiples vulnérabilités dans Adobe Acrobat et Reader · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*≥ 15.006.30060 ≤ 15.006.30508cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*≥ 15.008.20082 ≤ 19.021.20061cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*≥ 15.006.30060 ≤ 15.006.30508cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*≥ 15.008.20082 ≤ 19.021.20061cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*≥ 17.011.30059 ≤ 17.011.30156cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*≥ 17.011.30059 ≤ 17.011.30156
Affected products
| Product | Versions |
|---|---|
| Adobe · Adobe Acrobat and Reader | affected , 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier versions |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |