Multiple vulnerabilities in Adobe Acrobat and Adobe Reader

Description

Multiple serious vulnerabilities have been found in Adobe Acrobat and Adobe Reader. Malicious users can exploit these vulnerabilities to obtain sensitive information or execute arbitrary code.

Below is a complete list of vulnerabilities:

1. Memory corruption vulnerability related to reading a JPEG file embedded within XPS (XML Paper Specification) file can be exploited remotely to execute arbitrary code;
2. Memory corruption vulnerability related to font parsing can be exploited remotely via the font embedded within XPS file to execute arbitrary code;
3. Heap overflow vulnerability in the JPEG parser can be exploited remotely to execute arbitrary code;
4. Multiple memory corruption vulnerabilities in the image conversion engine which occur while processing EMF (Enhanced Metafile Format) data can be exploited remotely to execute arbitrary code;
5. Use-after-free vulnerability in the XFA event management can be exploited remotely to execute arbitrary code;
6. Use-after-free vulnerability in the XFA rendering engine can be exploited remotely to execute arbitrary code;
7. Heap overflow vulnerability in an internal data structure can be exploited remotely to execute arbitrary code;
8. Type confusion vulnerability in the annotation functionality can be exploited remotely to execute arbitrary code;
9. Memory corruption vulnerability in the PRC (Product Representation Compact) can be exploited remotely to execute arbitrary code;
10. Use-after-free vulnerability in the core of the XFA engine can be exploited remotely to execute arbitrary code;
11. Multiple memory corruption vulnerabilities related to processing JPEG 2000 (JP2) code stream data in the image processing engine and in the image conversion engine can be exploited remotely to execute arbitrary code;
12. Multiple memory corruption vulnerabilities related to processing EMF private data in the image conversion engine can be exploited remotely to execute arbitrary code;
13. Security bypass vulnerability related to manipulating FDF (Forms Data Format) can be exploited remotely to execute arbitrary code;
14. Multiple memory corruption vulnerabilities in the JPEG 2000 engine, in the font parsing module, in the XSLT engine, in the JPEG 2000 parsing module, in the AGM (Adobe Graphics Manager) module and in the PCX (picture exchange) file format parsing module can be exploited remotely to execute arbitrary code;
15. Use-after-free vulnerability in Acrobat/Reader engine can be exploited remotely to execute arbitrary code;
16. Use-after-free vulnerability related to brush manipulation which occurs while processing EMF (Enhanced Metafile Format) data can be exploited remotely to execute arbitrary code;
17. Memory corruption vulnerability related to the way of storing pixels while processing TIFF data can be exploited remotely to execute arbitrary code;
18. Use-after-free vulnerability in the image conversion engine related to decompressing JPEG data can be exploited remotely to execute arbitrary code;
19. Memory corruption vulnerability related to the internal handling of UTF-16 literal strings can be exploited remotely to execute arbitrary code;
20. Memory corruption vulnerability in the image conversion engine can be exploited remotely via specially designed EMF record to execute arbitrary code;
21. Use-after-free vulnerability in the Acrobat/Reader’s JavaScript engine can be exploited remotely to execute arbitrary code;
22. Memory corruption vulnerability in the image conversion engine related to processing TIFF color map data can be exploited remotely to execute arbitrary code;
23. Use-after-free vulnerability related to generating content in the XFA layout engine can be exploited remotely to execute arbitrary code;
24. Type confusion vulnerability in the XFA layout engine can be exploited remotely to execute arbitrary code;
25. Multiple memory corruption vulnerabilities related to processing EMF private data interpreted as a GIF image or JPEG data in the image conversion engine can be exploited remotely to execute arbitrary code;
26. Memory corruption vulnerability related to processing EMF private data and the embedded TIF image in the image conversion engine can be exploited remotely to execute arbitrary code;
27. Memory corruption vulnerability related to document encoding in the internal data structure manipulation can be exploited remotely to execute arbitrary code;
28. Memory corruption vulnerability related to processing EMF image stream data in the image conversion engine can be exploited remotely to execute arbitrary code;
29. Memory corruption vulnerability related to processing EMF private data representing icons in the image conversion engine can be exploited remotely to execute arbitrary code;
30. Memory corruption vulnerability can be exploited remotely to execute arbitrary code;
31. Use-after-free vulnerability related to creating large strings in the JavaScript engine can be exploited remotely to execute arbitrary code;
32. Insufficient verification of data authenticity related to handling links within the PDF can be exploited remotely to obtain sensitive information;
33. Memory corruption vulnerability related to parsing TrueType font data in the MakeAccessible plugin can be exploited remotely to execute arbitrary code;
34. Heap overflow vulnerability in the plugin which handles links within the PDF can be exploited remotely to execute arbitrary code;
35. Multiple memory corruption vulnerability in the Acrobat/Reader engine and in the EMF parser can be exploited remotely to execute arbitrary code;
36. Use-after-free vulnerability related to handling certain types of internal instructions in the XFA parsing engine can be exploited remotely to execute arbitrary code;
37. Memory corruption vulnerability related to processing EMF data drawing position definition in the image conversion engine can be exploited remotely to execute arbitrary code;
38. Memory corruption vulnerability related to parsing TTF (TrueType font format) stream data can be exploited remotely to execute arbitrary code.

---

Technical details

Vulnerabilities (4) are related to text output, rendering a path, bitmap transformations, drawing of Unicode text strings, curve drawing, text strings, polygons, line segments, transformation of blocks of pixels, drawing ASCII text string, transfer of pixel blocks, Bezier curves.

Original advisories

• Adobe Security Bulletin

• Update to Security Bulletin

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Adobe-Reader
• Adobe-Acrobat
• Adobe-Reader-XI
• Adobe-Acrobat-XI
• Adobe-Acrobat-Reader-DC-Continuous
• Adobe-Acrobat-Reader-DC-Classic
• Adobe-Acrobat-DC-Continuous
• Adobe-Acrobat-DC-Classic
• Adobe-Acrobat-Reader-2017
• Adobe-Acrobat-2017
• Adobe-Acrobat-Reader

CVE list

• CVE-2017-3038
  critical
• CVE-2017-11221
  critical
• CVE-2017-11222
  critical
• CVE-2017-11223
  critical
• CVE-2017-11224
  critical
• CVE-2017-11226
  critical
• CVE-2017-11227
  critical
• CVE-2017-11228
  critical
• CVE-2017-11229
  critical
• CVE-2017-11230
  high
• CVE-2017-11231
  critical
• CVE-2017-11232
  high
• CVE-2017-11233
  high
• CVE-2017-11234
  critical
• CVE-2017-11235
  critical
• CVE-2017-11236
  high
• CVE-2017-11237
  critical
• CVE-2017-11238
  high
• CVE-2017-11239
  high
• CVE-2017-11241
  critical
• CVE-2017-11242
  high
• CVE-2017-11243
  high
• CVE-2017-11244
  high
• CVE-2017-11245
  high
• CVE-2017-11246
  high
• CVE-2017-11248
  high
• CVE-2017-11249
  high
• CVE-2017-11251
  critical
• CVE-2017-11252
  high
• CVE-2017-11254
  critical
• CVE-2017-11255
  high
• CVE-2017-11256
  critical
• CVE-2017-11257
  critical
• CVE-2017-11258
  high
• CVE-2017-11259
  critical
• CVE-2017-11260
  critical
• CVE-2017-11261
  critical
• CVE-2017-11262
  critical
• CVE-2017-11263
  critical
• CVE-2017-11265
  high
• CVE-2017-11267
  critical
• CVE-2017-11268
  critical
• CVE-2017-11269
  critical
• CVE-2017-11270
  critical
• CVE-2017-11271
  critical
• CVE-2017-3016
  critical
• CVE-2017-3113
  critical
• CVE-2017-3115
  high
• CVE-2017-3116
  critical
• CVE-2017-3117
  critical
• CVE-2017-3118
  high
• CVE-2017-3119
  critical
• CVE-2017-3120
  critical
• CVE-2017-3121
  critical
• CVE-2017-3122
  high
• CVE-2017-3123
  critical
• CVE-2017-3124
  critical
• CVE-2017-11209
  high
• CVE-2017-11210
  high
• CVE-2017-11211
  critical
• CVE-2017-11212
  critical
• CVE-2017-11214
  critical
• CVE-2017-11216
  critical
• CVE-2017-11217
  high
• CVE-2017-11218
  critical
• CVE-2017-11219
  critical
• CVE-2017-11220
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com