Skip to content
OpenAdvisories
High NCSC-2024-0223 12 CVEs

Kwetsbaarheden verholpen in Adobe Acrobat Reader

Published May 16, 2024 · Updated May 16, 2024 · nl

Vendor: Adobe Product: Acrobat Reader Product: acrobat_reader_2020

Summary

Adobe heeft kwetsbaarheden verholpen in Acrobat Reader.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om willekeurige code uit te voeren met rechten van het slachtoffer, of toegang te krijgen tot gevoelige gegevens.

Oplossingen
Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen in Acrobat Reader DC 24.002.20759 en Acrobat Reader 2020 20.005.30636 (Windows) & 20.005.30635 (MacOS). Voor meer informatie, zie bijgevoegde referenties.

https://helpx.adobe.com/security/products/acrobat/apsb24-29.html

Vulnerabilities 12

  • High 7.8
    CVE-2024-30284

    ZDI-CAN-23466: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-30310

    ZDI-CAN-23327: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that …

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34094

    ZDI-CAN-23474: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34095

    ZDI-CAN-23475: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34096

    ZDI-CAN-23472: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34097

    ZDI-CAN-23473: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34098

    ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 1 of 2

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34099

    ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 2 of 2

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in t…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2024-34100

    Use-After-Free vulnerability in the latest Adobe Acrobat Reader DC when open malicious PDF file

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vict…

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2024-30311

    TALOS-2024-1946 - Adobe Acrobat Reader Font gvar GlyphVariationData out-of-bounds read vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2024-30312

    TALOS-2024-1952 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2024-34101

    ZDI-CAN-23614: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

    Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exp…

    Adobe Acrobat Reader

Revision history

  1. #0

    Initiele versie

References

  • Source - adobe
    https://helpx.adobe.com/security/products/acrobat/apsb24-29.html