CVSS: 9.3EPSS: 1%CPEs: 8EXPL: 0CVE-2017-16385 – Adobe Acrobat Pro DC XPS TIFF PhotometricInterpretation Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-16385
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in TIFF parsing during XPS conversion. Crafted TIFF image input causes a mismatch between allocated buffer size and the access allowed by the computation. If an attacker can adequately control the accessible memory then this vulnerability can be leveraged to achieve arbitrary code execution. Se ha descubierto un problema en Adobe Acrobat y Reader: 2017.012.20098 y versiones anteriores, 2017.011.30066 y versiones anteriores, 2015.006.30355 y versiones anteriores y 11.0.22 y versiones anteriores. • http://www.securityfocus.com/bid/101831 http://www.securitytracker.com/id/1039791 https://helpx.adobe.com/security/products/acrobat/apsb17-36.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 30%CPEs: 8EXPL: 0CVE-2016-1007 – Adobe Reader DC Uninitialized Memory Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1007
Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1009. Adobe Reader y Acrobat en versiones anteriores a 11.0.15, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30121, y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20060 on Windows y OS X permiten a atacantes ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-1009. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of annotation gestures. The issue lies in the failure to properly initialize the gestures property prior to using it, leading to memory corruption. • http://www.securityfocus.com/bid/84215 http://www.securitytracker.com/id/1035199 http://www.zerodayinitiative.com/advisories/ZDI-16-189 https://helpx.adobe.com/security/products/acrobat/apsb16-09.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.4EPSS: 96%CPEs: 8EXPL: 0CVE-2016-1008 – Adobe Acrobat Pro DC DLL Planting Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1008
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allows local users to gain privileges via a Trojan horse DLL in an unspecified directory. Vulnerabilidad de búsqueda de ruta no confiable en Adobe Reader y Acrobat en versiones anteriores a 11.0.15, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30121 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20060 on Windows y OS X permiten a usarios locales obtener privilegios a través de un Troyano DLL en un directorio no especificado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the handling of DLL search paths. In specific situations an attacker can force Acrobat Pro DC to load an arbitrary DLL from specific locations. • http://www.securityfocus.com/bid/84216 http://www.securitytracker.com/id/1035199 http://www.zerodayinitiative.com/advisories/ZDI-16-190 https://helpx.adobe.com/security/products/acrobat/apsb16-09.html • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 30%CPEs: 8EXPL: 0CVE-2016-1009 – Adobe Reader Out-Of-Bounds Indexing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1009
Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1007. Adobe Reader y Acrobat en versiones anteriores a 11.0.15, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30121 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20060 on Windows y OS X permiten a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de la memoria) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-1007. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PDFs. The issue lies in the failure to ensure that indexes are within the bounds of an allocated buffer. • http://www.securityfocus.com/bid/84215 http://www.securitytracker.com/id/1035199 http://www.zerodayinitiative.com/advisories/ZDI-16-191 https://helpx.adobe.com/security/products/acrobat/apsb16-09.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 2%CPEs: 38EXPL: 0CVE-2016-0933
https://notcve.org/view.php?id=CVE-2016-0933
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946. Adobe Reader y Acrobat en versiones anteriores a 11.0.14, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30119 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20056 en Windows y OS X permite a atacantes ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-0931, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945 y CVE-2016-0946. • http://www.securitytracker.com/id/1034646 https://helpx.adobe.com/security/products/acrobat/apsb16-02.html https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1217 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •