Multiple vulnerabilities in Adobe Acrobat and Adobe Reader

Description

Multiple serious vulnerabilities have been found in Adobe Acrobat and Adobe Reader. Malicious users can exploit these vulnerabilities to execute arbitary code and possibly cause a denial of service.

Below is a complete list of vulnerabilities:

1. Use-after-free vulnerabilities in the XML Forms Architecture (XFA) module related to reset form functionality and to the choiceList element can be exploited remotely to execute arbitrary code;
2. Use-after-free vulnerability occuring while manipulating an internal data structure can be exploited remotely to execute arbitrary code;
3. Use-after-free vulnerability in the XML Forms Architecture (XFA) engine can be exploited remotely to execute arbitrary code;
4. Use-after-free vulnerability in the JavaScript engine’s annotation-related API and in the JavaScript API connected with the collaboration functionality can be exploited remotely to execute arbitrary code;
5. Heap buffer overflow vulnerabilities in image conversion which are related to parsing offsets, internal scan line representation and internal tile manipulation in TIFF files can be exploited remotely to execute arbitrary code;
6. Heap buffer overflow vulnerability related to JPEG 2000 parsing of the fragment list tag can be exploited remotely to execute arbitrary code;
7. Memory corruption vulnerabilities in the JBIG2 parsing functionality, in the renderer functionality, in the JPEG 2000 code-stream tile functionality can be exploited remotely to execute arbitrary code;
8. Memory corruption vulnerability which occurs while handling a malformed PDF file can be exploited remotely to execute arbitrary code;
9. Memory corruption vulnerability in the PRC (Product Representation Compact) format parser can be exploited remotely to execute arbitrary code;
10. Memory corruption vulnerability which occurs while manipulating PDF annotations can be exploited remotely to execute arbitrary code;
11. Memory corruption vulnerability which is related to internal object representation manipulation can be exploited remotely to execute arbitrary code;
12. Memory corruption vulnerabilities in the image conversion module which are related to processing of TIFF files, processing of the PCX (picture exchange) file format, parsing of GIF files, parsing of JPEG files, manipulating EMF files can be exploited remotely to execute arbitrary code;
13. Memory corruption vulnerabilities in the modules: AES, JBIG2 image compression can be exploited remotely to execute arbitrary code;
14. Memory corruption vulnerabilities in the JavaScript engine and PPKLite security handler can be exploited remotely to execute arbitrary code;
15. Memory corruption vulnerability which occurs while parsing TFF (TrueType font format) stream data can be exploited remotely to execute arbitrary code;
16. Memory corruption vulnerability in the MakeAccessible plugin which occurs while parsing font data can be exploited remotely to execute arbitrary code;
17. Memory corruption vulnerability in the JPEG 2000 engine which is related to image scaling can be exploited remotely to execute arbitrary code;
18. Memory corruption vulnerability in the JavaScript engine which is related to string manipulation can be exploited remotely to execute arbitrary code;
19. Memory corruption vulnerability in the font manipulation functionality can be exploited remotely to execute arbitrary code;
20. Integer overflow vulnerability in the CCITT fax PDF filter and in the XFA (XML Forms Achitecture) engine can be exploited remotely to execute arbitrary code;
21. Multiple vulnerabilities in the weblink module, in the JPEG 2000 parser engine, in the XSLT engine, in the JPEG 2000 code-stream parser can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
22. An incorrect parsing of a JPEG 2000 file, incorrect handling of a JPEG 2000 code-stream and code-stream tile data can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
23. An unspecified vulnerability in the collaboration functionality can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
24. Multiple vulnerabilities in the JPEG 2000 parser, which are related to the palette box functionality and contiguous code-stream parsing can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
25. Multiple vulnerabilities in the image conversion engive which are related to EMF (enhanced meta file format) parsing and APP13 segment in JPEG files parsing can be exploited remotely to cause memory leak, which might lead to obtaining sensitive information or a denial of service;
26. Insecure library loading vulnerabilities (DLL hijacking) in the OCR plugin and in a DLL which is related to remote logging can be exploited remotely to execute arbitrary code.

NB: This vulnerability have no public CVSS rating so rating can be changed by the time.

Original advisories

• Adobe security bulletin

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Adobe-Reader-XI
• Adobe-Acrobat-XI
• Adobe-Acrobat-Reader-DC-Continuous
• Adobe-Acrobat-Reader-DC-Classic
• Adobe-Acrobat-DC-Continuous
• Adobe-Acrobat-DC-Classic

CVE list

• CVE-2017-3011
  critical
• CVE-2017-3012
  critical
• CVE-2017-3013
  critical
• CVE-2017-3014
  critical
• CVE-2017-3015
  critical
• CVE-2017-3018
  critical
• CVE-2017-3019
  critical
• CVE-2017-3020
  warning
• CVE-2017-3021
  warning
• CVE-2017-3022
  warning
• CVE-2017-3024
  critical
• CVE-2017-3025
  critical
• CVE-2017-3026
  critical
• CVE-2017-3027
  critical
• CVE-2017-3028
  critical
• CVE-2017-3030
  critical
• CVE-2017-3031
  warning
• CVE-2017-3032
  warning
• CVE-2017-3033
  warning
• CVE-2017-3034
  critical
• CVE-2017-3036
  critical
• CVE-2017-3037
  critical
• CVE-2017-3038
  critical
• CVE-2017-3039
  critical
• CVE-2017-3040
  critical
• CVE-2017-3042
  critical
• CVE-2017-3043
  warning
• CVE-2017-3044
  critical
• CVE-2017-3045
  warning
• CVE-2017-3046
  warning
• CVE-2017-3048
  critical
• CVE-2017-3049
  critical
• CVE-2017-3050
  critical
• CVE-2017-3051
  critical
• CVE-2017-3052
  warning
• CVE-2017-3054
  critical
• CVE-2017-3055
  critical
• CVE-2017-3056
  critical
• CVE-2017-3057
  critical
• CVE-2017-3065
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com