Adobe Acrobat Reader DC PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (Adobe Acrobat Reader)
En bref
- Source
- NVD
- EPSS
- EPSS 4.94 % · centile 92 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- adobe
- Statut NVD
- Modified
Rechercher sur…
Description
Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Heap-based Buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Faiblesses (CWE)
- CWE-122 — Débordement de tampon sur le tas
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | adobe |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · psirt@adobe.com (Secondary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2021-15307
- GCVE · GCVE-0-2021-28638
Avis du CERT-FR
- CERTFR-2021-AVI-525 — Multiples vulnérabilités dans Adobe Acrobat · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*≥ 15.008.20082 ≤ 21.005.20054cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*≥ 17.011.30059 ≤ 17.011.30197cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*≥ 20.001.30005 ≤ 20.004.30005cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*≥ 15.008.20082 ≤ 21.005.20054cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*≥ 17.011.30059 ≤ 17.011.30197cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*≥ 20.001.30005 ≤ 20.004.30005
Produits affectés
| Produit | Versions |
|---|---|
| Adobe · Acrobat Reader | affected unspecified ≤ 2020.004.30005 ; affected unspecified ≤ 2017.011.30197 ; affected unspecified ≤ 2021.005.20054 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |