ID CVE-2017-3021
Summary Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 parser engine.
References
Vulnerable Configurations
  • Adobe Acrobat 11.0.19
    cpe:2.3:a:adobe:acrobat:11.0.19
  • Adobe Acrobat Document Cloud 15.006.30280 Classic Track
    cpe:2.3:a:adobe:acrobat_dc:15.006.30280:-:-:-:classic
  • Adobe Acrobat Document Cloud 15.023.20070 Continuous Track
    cpe:2.3:a:adobe:acrobat_dc:15.023.20070:-:-:-:continuous
  • Adobe Acrobat Reader Document Cloud 15.006.30280 Classic Track
    cpe:2.3:a:adobe:acrobat_reader_dc:15.006.30280:-:-:-:classic
  • Adobe Acrobat Reader Document Cloud 15.023.20070 Continuous Track
    cpe:2.3:a:adobe:acrobat_reader_dc:15.023.20070:-:-:-:continuous
  • cpe:2.3:a:adobe:reader:11.0.19
    cpe:2.3:a:adobe:reader:11.0.19
  • Apple Mac OS X
    cpe:2.3:o:apple:mac_os_x
  • Microsoft Windows
    cpe:2.3:o:microsoft:windows
CVSS
Base: 4.3 (as of 17-04-2017 - 16:13)
Impact:
Exploitability:
CWE CWE-125
CAPEC
  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family Windows
    NASL id ADOBE_ACROBAT_APSB17-11.NASL
    description The version of Adobe Acrobat installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exists that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-30
    plugin id 99373
    published 2017-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99373
    title Adobe Acrobat < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_ADOBE_ACROBAT_APSB17-11.NASL
    description The version of Adobe Acrobat installed on the remote macOS or Mac OS X host is a version prior to 11.0.20, 2015.006.30306, 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exists that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 99375
    published 2017-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99375
    title Adobe Acrobat < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11) (macOS)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_ADOBE_READER_APSB17-11.NASL
    description The version of Adobe Reader installed on the remote macOS or Mac OS X host is a version prior to 11.0.20, 2015.006.30306, 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exists that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 99376
    published 2017-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99376
    title Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11) (macOS)
  • NASL family Windows
    NASL id ADOBE_READER_APSB17-11.NASL
    description The version of Adobe Reader installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities : - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2017-3014, CVE-2017-3026, CVE-2017-3027, CVE-2017-3035, CVE-2017-3047, CVE-2017-3057) - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049, CVE-2017-3055) - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2017-3015, CVE-2017-3017, CVE-2017-3018, CVE-2017-3019, CVE-2017-3023, CVE-2017-3024, CVE-2017-3025, CVE-2017-3028, CVE-2017-3030, CVE-2017-3036, CVE-2017-3037, CVE-2017-3038, CVE-2017-3039, CVE-2017-3040, CVE-2017-3041, CVE-2017-3044, CVE-2017-3050, CVE-2017-3051, CVE-2017-3054, CVE-2017-3056, CVE-2017-3065) - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2017-3011, CVE-2017-3034) - Multiple memory corruption issues exist that allow an an attacker to disclose memory address information. (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022, CVE-2017-3029, CVE-2017-3031, CVE-2017-3032, CVE-2017-3033, CVE-2017-3043, CVE-2017-3045, CVE-2017-3046, CVE-2017-3052, CVE-2017-3053) - A flaw exists due to the use of an insecure directory search path. An attacker can potentially exploit this to execute arbitrary code. (CVE-2017-3012, CVE-2017-3013) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
    last seen 2019-02-21
    modified 2019-01-30
    plugin id 99374
    published 2017-04-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99374
    title Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)
refmap via4
bid 97554
confirm https://helpx.adobe.com/security/products/acrobat/apsb17-11.html
sectrack 1038228
Last major update 18-04-2017 - 07:56
Published 12-04-2017 - 10:59
Last modified 10-07-2017 - 21:33
Back to Top