Beschreibung
Multiple serious vulnerabilities have been found in Adobe Acrobat and Adobe Reader. Malicious users can exploit these vulnerabilities to execute arbitary code and possibly cause a denial of service.
Below is a complete list of vulnerabilities:
- Use-after-free vulnerabilities in the XML Forms Architecture (XFA) module related to reset form functionality and to the choiceList element can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability occuring while manipulating an internal data structure can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in the XML Forms Architecture (XFA) engine can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in the JavaScript engine’s annotation-related API and in the JavaScript API connected with the collaboration functionality can be exploited remotely to execute arbitrary code;
- Heap buffer overflow vulnerabilities in image conversion which are related to parsing offsets, internal scan line representation and internal tile manipulation in TIFF files can be exploited remotely to execute arbitrary code;
- Heap buffer overflow vulnerability related to JPEG 2000 parsing of the fragment list tag can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerabilities in the JBIG2 parsing functionality, in the renderer functionality, in the JPEG 2000 code-stream tile functionality can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability which occurs while handling a malformed PDF file can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the PRC (Product Representation Compact) format parser can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability which occurs while manipulating PDF annotations can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability which is related to internal object representation manipulation can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerabilities in the image conversion module which are related to processing of TIFF files, processing of the PCX (picture exchange) file format, parsing of GIF files, parsing of JPEG files, manipulating EMF files can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerabilities in the modules: AES, JBIG2 image compression can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerabilities in the JavaScript engine and PPKLite security handler can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability which occurs while parsing TFF (TrueType font format) stream data can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the MakeAccessible plugin which occurs while parsing font data can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the JPEG 2000 engine which is related to image scaling can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the JavaScript engine which is related to string manipulation can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the font manipulation functionality can be exploited remotely to execute arbitrary code;
- Integer overflow vulnerability in the CCITT fax PDF filter and in the XFA (XML Forms Achitecture) engine can be exploited remotely to execute arbitrary code;
- Multiple vulnerabilities in the weblink module, in the JPEG 2000 parser engine, in the XSLT engine, in the JPEG 2000 code-stream parser can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
- An incorrect parsing of a JPEG 2000 file, incorrect handling of a JPEG 2000 code-stream and code-stream tile data can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
- An unspecified vulnerability in the collaboration functionality can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
- Multiple vulnerabilities in the JPEG 2000 parser, which are related to the palette box functionality and contiguous code-stream parsing can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
- Multiple vulnerabilities in the image conversion engive which are related to EMF (enhanced meta file format) parsing and APP13 segment in JPEG files parsing can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
- Insecure library loading vulnerabilities (DLL hijacking) in the OCR plugin and in a DLL which is related to remote logging can be exploited remotely to execute arbitrary code.
NB: This vulnerability have no public CVSS rating so rating can be changed by the time.
Ursprüngliche Informationshinweise
CVE Liste
- CVE-2017-3011 critical
- CVE-2017-3012 critical
- CVE-2017-3013 critical
- CVE-2017-3014 critical
- CVE-2017-3015 critical
- CVE-2017-3018 critical
- CVE-2017-3019 critical
- CVE-2017-3020 critical
- CVE-2017-3021 critical
- CVE-2017-3022 critical
- CVE-2017-3024 critical
- CVE-2017-3025 critical
- CVE-2017-3026 critical
- CVE-2017-3027 critical
- CVE-2017-3028 critical
- CVE-2017-3030 critical
- CVE-2017-3031 critical
- CVE-2017-3032 critical
- CVE-2017-3033 critical
- CVE-2017-3034 critical
- CVE-2017-3036 critical
- CVE-2017-3037 critical
- CVE-2017-3038 critical
- CVE-2017-3039 critical
- CVE-2017-3040 critical
- CVE-2017-3042 critical
- CVE-2017-3043 critical
- CVE-2017-3044 critical
- CVE-2017-3045 critical
- CVE-2017-3046 critical
- CVE-2017-3048 critical
- CVE-2017-3049 critical
- CVE-2017-3050 critical
- CVE-2017-3051 critical
- CVE-2017-3052 critical
- CVE-2017-3054 critical
- CVE-2017-3055 critical
- CVE-2017-3056 critical
- CVE-2017-3057 critical
- CVE-2017-3065 critical
Mehr erfahren
Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com
Sie haben einen Fehler in der Beschreibung der Schwachstelle gefunden? Mitteilen!