Skip to content
OpenAdvisories
High WID-SEC-2023-0922 16 CVEs

Adobe PDF Produkte: Mehrere Schwachstellen

Published Apr 11, 2023 · Updated Apr 11, 2023 · de-DE

Vendor: Adobe Product: Acrobat < 20.005.30467 Product: Acrobat DC < 23.001.20143 Product: Acrobat Reader < 20.005.30467 Product: Acrobat Reader DC < 23.001.20143 Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Adobe Acrobat DC, Adobe Acrobat Reader DC, Adobe Acrobat und Adobe Acrobat Reader ausnutzen, um die Privilegien zu erweitern, beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.

Product

Adobe Acrobat ist ein Programm für die Erstellung und Betrachtung von Dokumenten im Adobe Portable Document Format (PDF).
Acrobat Reader ist ein Programm für die Anzeige von Dokumenten im Adobe Portable Document Format (PDF).
Adobe Reader ist ein Programm für die Anzeige von Dokumenten im Adobe Portable Document Format (PDF).

Vulnerabilities 16

  • High 7.8
    CVE-2023-26395

    Adobe Acrobat parsing PDF Out-of-bounds Write Arbitrary code execution

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires …

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26396

    Adobe Acrobat Reader DC for macOS installer (AcroRdrDC_2200220191_MUI.pkg) contains a local privilege escalation vulnerability.

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current …

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26405

    ZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions Bypass

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue req…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26406

    ZDI-CAN-20712: Net.HTTP.request URL restriction bypass

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requi…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26407

    ZDI-CAN-20712: Net.HTTP.request Arbitrary Command Execution

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue req…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26408

    ZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requi…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26417

    ZDI-CAN-20583: Adobe Acrobat Reader DC Popup Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26418

    ZDI-CAN-20311: Adobe Acrobat Reader DC AcroForm exportAsFDFStr Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26419

    ZDI-CAN-20274: Adobe Acrobat Reader DC AcroForm removeField Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26420

    ZDI-CAN-20227: Adobe Acrobat Reader DC AcroForm addField Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26421

    ZDI-CAN-19832: Adobe Acrobat Reader DC Doc Object Integer Underflow Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Integer Underflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this iss…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26422

    ZDI-CAN-20176: Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26423

    ZDI-CAN-20160: Adobe Acrobat Reader DC AcroForm insertItemAt Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26424

    ZDI-CAN-19833: Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user i…

    Adobe Acrobat Reader
  • High 7.8
    CVE-2023-26425

    ZDI-CAN-19854: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker co…

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2023-26397

    [ZS-VR-22-112] Adobe Acrobat Out-of-bounds Read Memory leak

    Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations …

    Adobe Acrobat Reader

Revision history

  1. #1

    Initiale Fassung

References