Beschreibung
Multiple serious vulnerabilities have been found in Adobe Acrobat and Adobe Reader. Malicious users can exploit these vulnerabilities to obtain sensitive information or execute arbitrary code.
Below is a complete list of vulnerabilities:
- Memory corruption vulnerability related to reading a JPEG file embedded within XPS (XML Paper Specification) file can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to font parsing can be exploited remotely via the font embedded within XPS file to execute arbitrary code;
- Heap overflow vulnerability in the JPEG parser can be exploited remotely to execute arbitrary code;
- Multiple memory corruption vulnerabilities in the image conversion engine which occur while processing EMF (Enhanced Metafile Format) data can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in the XFA event management can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in the XFA rendering engine can be exploited remotely to execute arbitrary code;
- Heap overflow vulnerability in an internal data structure can be exploited remotely to execute arbitrary code;
- Type confusion vulnerability in the annotation functionality can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the PRC (Product Representation Compact) can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in the core of the XFA engine can be exploited remotely to execute arbitrary code;
- Multiple memory corruption vulnerabilities related to processing JPEG 2000 (JP2) code stream data in the image processing engine and in the image conversion engine can be exploited remotely to execute arbitrary code;
- Multiple memory corruption vulnerabilities related to processing EMF private data in the image conversion engine can be exploited remotely to execute arbitrary code;
- Security bypass vulnerability related to manipulating FDF (Forms Data Format) can be exploited remotely to execute arbitrary code;
- Multiple memory corruption vulnerabilities in the JPEG 2000 engine, in the font parsing module, in the XSLT engine, in the JPEG 2000 parsing module, in the AGM (Adobe Graphics Manager) module and in the PCX (picture exchange) file format parsing module can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in Acrobat/Reader engine can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability related to brush manipulation which occurs while processing EMF (Enhanced Metafile Format) data can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to the way of storing pixels while processing TIFF data can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability in the image conversion engine related to decompressing JPEG data can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to the internal handling of UTF-16 literal strings can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the image conversion engine can be exploited remotely via specially designed EMF record to execute arbitrary code;
- Use-after-free vulnerability in the Acrobat/Reader’s JavaScript engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability in the image conversion engine related to processing TIFF color map data can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability related to generating content in the XFA layout engine can be exploited remotely to execute arbitrary code;
- Type confusion vulnerability in the XFA layout engine can be exploited remotely to execute arbitrary code;
- Multiple memory corruption vulnerabilities related to processing EMF private data interpreted as a GIF image or JPEG data in the image conversion engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to processing EMF private data and the embedded TIF image in the image conversion engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to document encoding in the internal data structure manipulation can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to processing EMF image stream data in the image conversion engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to processing EMF private data representing icons in the image conversion engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability related to creating large strings in the JavaScript engine can be exploited remotely to execute arbitrary code;
- Insufficient verification of data authenticity related to handling links within the PDF can be exploited remotely to obtain sensitive information;
- Memory corruption vulnerability related to parsing TrueType font data in the MakeAccessible plugin can be exploited remotely to execute arbitrary code;
- Heap overflow vulnerability in the plugin which handles links within the PDF can be exploited remotely to execute arbitrary code;
- Multiple memory corruption vulnerability in the Acrobat/Reader engine and in the EMF parser can be exploited remotely to execute arbitrary code;
- Use-after-free vulnerability related to handling certain types of internal instructions in the XFA parsing engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to processing EMF data drawing position definition in the image conversion engine can be exploited remotely to execute arbitrary code;
- Memory corruption vulnerability related to parsing TTF (TrueType font format) stream data can be exploited remotely to execute arbitrary code.
Technical details
Vulnerabilities (4) are related to text output, rendering a path, bitmap transformations, drawing of Unicode text strings, curve drawing, text strings, polygons, line segments, transformation of blocks of pixels, drawing ASCII text string, transfer of pixel blocks, Bezier curves.
Ursprüngliche Informationshinweise
CVE Liste
- CVE-2017-3038 critical
- CVE-2017-11221 critical
- CVE-2017-11222 critical
- CVE-2017-11223 critical
- CVE-2017-11224 critical
- CVE-2017-11226 critical
- CVE-2017-11227 critical
- CVE-2017-11228 critical
- CVE-2017-11229 critical
- CVE-2017-11230 critical
- CVE-2017-11231 critical
- CVE-2017-11232 critical
- CVE-2017-11233 critical
- CVE-2017-11234 critical
- CVE-2017-11235 critical
- CVE-2017-11236 critical
- CVE-2017-11237 critical
- CVE-2017-11238 critical
- CVE-2017-11239 critical
- CVE-2017-11241 critical
- CVE-2017-11242 critical
- CVE-2017-11243 critical
- CVE-2017-11244 critical
- CVE-2017-11245 critical
- CVE-2017-11246 critical
- CVE-2017-11248 critical
- CVE-2017-11249 critical
- CVE-2017-11251 critical
- CVE-2017-11252 critical
- CVE-2017-11254 critical
- CVE-2017-11255 critical
- CVE-2017-11256 critical
- CVE-2017-11257 critical
- CVE-2017-11258 critical
- CVE-2017-11259 critical
- CVE-2017-11260 critical
- CVE-2017-11261 critical
- CVE-2017-11262 critical
- CVE-2017-11263 critical
- CVE-2017-11265 critical
- CVE-2017-11267 critical
- CVE-2017-11268 critical
- CVE-2017-11269 critical
- CVE-2017-11270 critical
- CVE-2017-11271 critical
- CVE-2017-3016 critical
- CVE-2017-3113 critical
- CVE-2017-3115 critical
- CVE-2017-3116 critical
- CVE-2017-3117 critical
- CVE-2017-3118 critical
- CVE-2017-3119 critical
- CVE-2017-3120 critical
- CVE-2017-3121 critical
- CVE-2017-3122 critical
- CVE-2017-3123 critical
- CVE-2017-3124 critical
- CVE-2017-11209 critical
- CVE-2017-11210 critical
- CVE-2017-11211 critical
- CVE-2017-11212 critical
- CVE-2017-11214 critical
- CVE-2017-11216 critical
- CVE-2017-11217 critical
- CVE-2017-11218 critical
- CVE-2017-11219 critical
- CVE-2017-11220 critical
Mehr erfahren
Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com
Sie haben einen Fehler in der Beschreibung der Schwachstelle gefunden? Mitteilen!