cvelistv5 - cve-2024-39425

CVE-2024-39425 (GCVE-0-2024-39425)

Vulnerability from cvelistv5

Published

2024-08-14 15:07

Modified

2024-08-15 03:55

Severity ?

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition ()

Summary

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.

References

URL

	Vendor	Product	Version
	Adobe	Acrobat Reader	Version: 0 ≤ 24.001.30123

cnvd-2024-39289

Vulnerability from cnvd

Title

Adobe Acrobat Reader存在未明漏洞（CNVD-2024-39289）

Description

Adobe Acrobat Reader是美国奥多比（Adobe）公司的一款PDF查看器。该软件用于打印，签名和注释PDF。 Adobe Acrobat Reader存在安全漏洞。攻击者可利用该漏洞导致提升权限。

Severity

中

Patch Name

Adobe Acrobat Reader存在未明漏洞（CNVD-2024-39289）的补丁

Patch Description

Adobe Acrobat Reader是美国奥多比（Adobe）公司的一款PDF查看器。该软件用于打印，签名和注释PDF。 Adobe Acrobat Reader存在安全漏洞。攻击者可利用该漏洞导致提升权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://helpx.adobe.com/security/products/acrobat/apsb24-57.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-39425

Impacted products

Name
['Adobe acrobat classic >=20.001.30005，<20.005.30655', 'Adobe acrobat classic >=24.001.20604，<24.001.30159', 'Adobe Acrobat DC Continuous >=15.008.20082，<24.002.21005', 'Adobe acrobat reader classic >=20.001.3005，<20.005.30655', 'Adobe acrobat reader dc continuous >=15.008.20082，<24.002.21005']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-39425",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425"
    }
  },
  "description": "Adobe Acrobat Reader\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u6b3ePDF\u67e5\u770b\u5668\u3002\u8be5\u8f6f\u4ef6\u7528\u4e8e\u6253\u5370\uff0c\u7b7e\u540d\u548c\u6ce8\u91caPDF\u3002\n\nAdobe Acrobat Reader\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u63d0\u5347\u6743\u9650\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://helpx.adobe.com/security/products/acrobat/apsb24-57.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-39289",
  "openTime": "2024-09-25",
  "patchDescription": "Adobe Acrobat Reader\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u6b3ePDF\u67e5\u770b\u5668\u3002\u8be5\u8f6f\u4ef6\u7528\u4e8e\u6253\u5370\uff0c\u7b7e\u540d\u548c\u6ce8\u91caPDF\u3002\r\n\r\nAdobe Acrobat Reader\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u63d0\u5347\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Adobe Acrobat Reader\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-39289\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe acrobat classic \u003e=20.001.30005\uff0c\u003c20.005.30655",
      "Adobe acrobat classic \u003e=24.001.20604\uff0c\u003c24.001.30159",
      "Adobe Acrobat DC Continuous \u003e=15.008.20082\uff0c\u003c24.002.21005",
      "Adobe acrobat reader classic \u003e=20.001.3005\uff0c\u003c20.005.30655",
      "Adobe acrobat reader dc continuous \u003e=15.008.20082\uff0c\u003c24.002.21005"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425",
  "serverity": "\u4e2d",
  "submitTime": "2024-08-16",
  "title": "Adobe Acrobat Reader\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-39289\uff09"
}

WID-SEC-W-2024-1833

Vulnerability from csaf_certbund

Published

2024-08-13 22:00

Modified

2024-12-01 23:00

Summary

Adobe Acrobat Reader: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Acrobat Reader ist ein Programm für die Anzeige von Dokumenten im Portable Document Format (PDF). Adobe Reader ist ein Programm für die Anzeige von Dokumenten im Portable Document Format (PDF). Adobe Acrobat ist ein Programm für die Erstellung und Betrachtung von Dokumenten im Portable Document Format (PDF).

Angriff

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Acrobat Reader ist ein Programm f\u00fcr die Anzeige von Dokumenten im Portable Document Format (PDF).\r\nAdobe Reader ist ein Programm f\u00fcr die Anzeige von Dokumenten im Portable Document Format (PDF).\r\nAdobe Acrobat ist ein Programm f\u00fcr die Erstellung und Betrachtung von Dokumenten im Portable Document Format (PDF).",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1833 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1833.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1833 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1833"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin vom 2024-08-13",
        "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Adobe Acrobat Reader: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-01T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-02T11:34:08.754+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-1833",
      "initial_release_date": "2024-08-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-08-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-09-04T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE\u0027s erg\u00e4nzt"
        },
        {
          "date": "2024-12-01T23:00:00.000+00:00",
          "number": "3",
          "summary": "Pr\u00fcfung Produkteintragung"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "2024 \u003c24.001.30159",
                "product": {
                  "name": "Adobe Acrobat 2024 \u003c24.001.30159",
                  "product_id": "T036785"
                }
              },
              {
                "category": "product_version",
                "name": "2024 24.001.30159",
                "product": {
                  "name": "Adobe Acrobat 2024 24.001.30159",
                  "product_id": "T036785-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat:2024__24.001.30159"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "2020 \u003c20.005.30655",
                "product": {
                  "name": "Adobe Acrobat 2020 \u003c20.005.30655",
                  "product_id": "T036786"
                }
              },
              {
                "category": "product_version",
                "name": "2020 20.005.30655",
                "product": {
                  "name": "Adobe Acrobat 2020 20.005.30655",
                  "product_id": "T036786-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat:2020__20.005.30655"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c24.002.21005",
                "product": {
                  "name": "Adobe Acrobat DC \u003c24.002.21005",
                  "product_id": "T036784"
                }
              },
              {
                "category": "product_version",
                "name": "24.002.21005",
                "product": {
                  "name": "Adobe Acrobat DC 24.002.21005",
                  "product_id": "T036784-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat_dc:24.002.21005"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat DC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "2020 \u003c20.005.30655",
                "product": {
                  "name": "Adobe Acrobat Reader 2020 \u003c20.005.30655",
                  "product_id": "T036782"
                }
              },
              {
                "category": "product_version",
                "name": "2020 20.005.30655",
                "product": {
                  "name": "Adobe Acrobat Reader 2020 20.005.30655",
                  "product_id": "T036782-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat_reader:2020__20.005.30655"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat Reader"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c24.002.21005",
                "product": {
                  "name": "Adobe Acrobat Reader DC \u003c24.002.21005",
                  "product_id": "T036783"
                }
              },
              {
                "category": "product_version",
                "name": "24.002.21005",
                "product": {
                  "name": "Adobe Acrobat Reader DC 24.002.21005",
                  "product_id": "T036783-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat_reader_dc:24.002.21005"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat Reader DC"
          }
        ],
        "category": "vendor",
        "name": "Adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-39383",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39383"
    },
    {
      "cve": "CVE-2024-39420",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39420"
    },
    {
      "cve": "CVE-2024-39422",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39422"
    },
    {
      "cve": "CVE-2024-39423",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39423"
    },
    {
      "cve": "CVE-2024-39424",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39424"
    },
    {
      "cve": "CVE-2024-39425",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39425"
    },
    {
      "cve": "CVE-2024-39426",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39426"
    },
    {
      "cve": "CVE-2024-41830",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41830"
    },
    {
      "cve": "CVE-2024-41831",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41831"
    },
    {
      "cve": "CVE-2024-41832",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41832"
    },
    {
      "cve": "CVE-2024-41833",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41833"
    },
    {
      "cve": "CVE-2024-41834",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41834"
    },
    {
      "cve": "CVE-2024-41835",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41835"
    },
    {
      "cve": "CVE-2024-45107",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-45107"
    }
  ]
}

wid-sec-w-2024-1833

Vulnerability from csaf_certbund

Published

2024-08-13 22:00

Modified

2024-12-01 23:00

Summary

Adobe Acrobat Reader: Mehrere Schwachstellen

Notes

Produktbeschreibung

Angriff

Betroffene Betriebssysteme

- MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Acrobat Reader ist ein Programm f\u00fcr die Anzeige von Dokumenten im Portable Document Format (PDF).\r\nAdobe Reader ist ein Programm f\u00fcr die Anzeige von Dokumenten im Portable Document Format (PDF).\r\nAdobe Acrobat ist ein Programm f\u00fcr die Erstellung und Betrachtung von Dokumenten im Portable Document Format (PDF).",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1833 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1833.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1833 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1833"
      },
      {
        "category": "external",
        "summary": "Adobe Security Bulletin vom 2024-08-13",
        "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Adobe Acrobat Reader: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-01T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-02T11:34:08.754+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.8"
        }
      },
      "id": "WID-SEC-W-2024-1833",
      "initial_release_date": "2024-08-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-08-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-09-04T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE\u0027s erg\u00e4nzt"
        },
        {
          "date": "2024-12-01T23:00:00.000+00:00",
          "number": "3",
          "summary": "Pr\u00fcfung Produkteintragung"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "2024 \u003c24.001.30159",
                "product": {
                  "name": "Adobe Acrobat 2024 \u003c24.001.30159",
                  "product_id": "T036785"
                }
              },
              {
                "category": "product_version",
                "name": "2024 24.001.30159",
                "product": {
                  "name": "Adobe Acrobat 2024 24.001.30159",
                  "product_id": "T036785-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat:2024__24.001.30159"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "2020 \u003c20.005.30655",
                "product": {
                  "name": "Adobe Acrobat 2020 \u003c20.005.30655",
                  "product_id": "T036786"
                }
              },
              {
                "category": "product_version",
                "name": "2020 20.005.30655",
                "product": {
                  "name": "Adobe Acrobat 2020 20.005.30655",
                  "product_id": "T036786-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat:2020__20.005.30655"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c24.002.21005",
                "product": {
                  "name": "Adobe Acrobat DC \u003c24.002.21005",
                  "product_id": "T036784"
                }
              },
              {
                "category": "product_version",
                "name": "24.002.21005",
                "product": {
                  "name": "Adobe Acrobat DC 24.002.21005",
                  "product_id": "T036784-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat_dc:24.002.21005"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat DC"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "2020 \u003c20.005.30655",
                "product": {
                  "name": "Adobe Acrobat Reader 2020 \u003c20.005.30655",
                  "product_id": "T036782"
                }
              },
              {
                "category": "product_version",
                "name": "2020 20.005.30655",
                "product": {
                  "name": "Adobe Acrobat Reader 2020 20.005.30655",
                  "product_id": "T036782-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat_reader:2020__20.005.30655"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat Reader"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c24.002.21005",
                "product": {
                  "name": "Adobe Acrobat Reader DC \u003c24.002.21005",
                  "product_id": "T036783"
                }
              },
              {
                "category": "product_version",
                "name": "24.002.21005",
                "product": {
                  "name": "Adobe Acrobat Reader DC 24.002.21005",
                  "product_id": "T036783-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:adobe:acrobat_reader_dc:24.002.21005"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Acrobat Reader DC"
          }
        ],
        "category": "vendor",
        "name": "Adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-39383",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39383"
    },
    {
      "cve": "CVE-2024-39420",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39420"
    },
    {
      "cve": "CVE-2024-39422",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39422"
    },
    {
      "cve": "CVE-2024-39423",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39423"
    },
    {
      "cve": "CVE-2024-39424",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39424"
    },
    {
      "cve": "CVE-2024-39425",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39425"
    },
    {
      "cve": "CVE-2024-39426",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-39426"
    },
    {
      "cve": "CVE-2024-41830",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41830"
    },
    {
      "cve": "CVE-2024-41831",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41831"
    },
    {
      "cve": "CVE-2024-41832",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41832"
    },
    {
      "cve": "CVE-2024-41833",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41833"
    },
    {
      "cve": "CVE-2024-41834",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41834"
    },
    {
      "cve": "CVE-2024-41835",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-41835"
    },
    {
      "cve": "CVE-2024-45107",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgem\u00e4\u00dfen \u00dcberpr\u00fcfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "product_status": {
        "known_affected": [
          "T036784",
          "T036785",
          "T036786",
          "T036782",
          "T036783"
        ]
      },
      "release_date": "2024-08-13T22:00:00.000+00:00",
      "title": "CVE-2024-45107"
    }
  ]
}

NCSC-2024-0347

Vulnerability from csaf_ncscnl

Published

2024-08-14 12:52

Modified

2024-08-14 12:52

Summary

Kwetsbaarheden verholpen in Adobe Acrobat en Acrobat Reader

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Adobe heeft kwetsbaarheden verholpen in Acrobat en Acrobat Reader.

Interpretaties

Een kwaadwillende kan de kwetsbaarheden misbruiken om willekeurige code uit te voeren met rechten van het slachtoffer en toegang te krijgen tot gevoelige gegevens. Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen.

Oplossingen

Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-125

Out-of-bounds Read

CWE-347

Improper Verification of Cryptographic Signature

CWE-416

Use After Free

CWE-787

Out-of-bounds Write

CWE-788

Access of Memory Location After End of Buffer

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Adobe heeft kwetsbaarheden verholpen in Acrobat en Acrobat Reader.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om willekeurige code uit te voeren met rechten van het slachtoffer en toegang te krijgen tot gevoelige gegevens.\n\nVoor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Improper Verification of Cryptographic Signature",
        "title": "CWE-347"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Access of Memory Location After End of Buffer",
        "title": "CWE-788"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - adobe",
        "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Adobe Acrobat en Acrobat Reader",
    "tracking": {
      "current_release_date": "2024-08-14T12:52:29.316273Z",
      "id": "NCSC-2024-0347",
      "initial_release_date": "2024-08-14T12:52:29.316273Z",
      "revision_history": [
        {
          "date": "2024-08-14T12:52:29.316273Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "acrobat_2020",
            "product": {
              "name": "acrobat_2020",
              "product_id": "CSAFPID-422885",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_2020:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_2024",
            "product": {
              "name": "acrobat_2024",
              "product_id": "CSAFPID-1615953",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_2024:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_dc",
            "product": {
              "name": "acrobat_dc",
              "product_id": "CSAFPID-422884",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_reader_2020",
            "product": {
              "name": "acrobat_reader_2020",
              "product_id": "CSAFPID-422886",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_reader_2020:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_reader_dc",
            "product": {
              "name": "acrobat_reader_dc",
              "product_id": "CSAFPID-371567",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-39383",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39383",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39383.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39383"
    },
    {
      "cve": "CVE-2024-39422",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39422",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39422.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39422"
    },
    {
      "cve": "CVE-2024-39423",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39423",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39423.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39423"
    },
    {
      "cve": "CVE-2024-39424",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39424",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39424.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39424"
    },
    {
      "cve": "CVE-2024-39425",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Verification of Cryptographic Signature",
          "title": "CWE-347"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39425",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39425.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39425"
    },
    {
      "cve": "CVE-2024-39426",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Memory Location After End of Buffer",
          "title": "CWE-788"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39426",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39426.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39426"
    },
    {
      "cve": "CVE-2024-41830",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41830",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41830.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41830"
    },
    {
      "cve": "CVE-2024-41831",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41831",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41831.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41831"
    },
    {
      "cve": "CVE-2024-41832",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41832",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41832.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41832"
    },
    {
      "cve": "CVE-2024-41833",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41833",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41833.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41833"
    },
    {
      "cve": "CVE-2024-41834",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41834",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41834.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41834"
    },
    {
      "cve": "CVE-2024-41835",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41835",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41835.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41835"
    }
  ]
}

ncsc-2024-0347

Vulnerability from csaf_ncscnl

Published

2024-08-14 12:52

Modified

2024-08-14 12:52

Summary

Kwetsbaarheden verholpen in Adobe Acrobat en Acrobat Reader

Notes

Feiten

Adobe heeft kwetsbaarheden verholpen in Acrobat en Acrobat Reader.

Interpretaties

Oplossingen

Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-125

Out-of-bounds Read

CWE-347

Improper Verification of Cryptographic Signature

CWE-416

Use After Free

CWE-787

Out-of-bounds Write

CWE-788

Access of Memory Location After End of Buffer

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Adobe heeft kwetsbaarheden verholpen in Acrobat en Acrobat Reader.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om willekeurige code uit te voeren met rechten van het slachtoffer en toegang te krijgen tot gevoelige gegevens.\n\nVoor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide bestand te openen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Adobe heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Improper Verification of Cryptographic Signature",
        "title": "CWE-347"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Access of Memory Location After End of Buffer",
        "title": "CWE-788"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Source - adobe",
        "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Adobe Acrobat en Acrobat Reader",
    "tracking": {
      "current_release_date": "2024-08-14T12:52:29.316273Z",
      "id": "NCSC-2024-0347",
      "initial_release_date": "2024-08-14T12:52:29.316273Z",
      "revision_history": [
        {
          "date": "2024-08-14T12:52:29.316273Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "acrobat_2020",
            "product": {
              "name": "acrobat_2020",
              "product_id": "CSAFPID-422885",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_2020:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_2024",
            "product": {
              "name": "acrobat_2024",
              "product_id": "CSAFPID-1615953",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_2024:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_dc",
            "product": {
              "name": "acrobat_dc",
              "product_id": "CSAFPID-422884",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_reader_2020",
            "product": {
              "name": "acrobat_reader_2020",
              "product_id": "CSAFPID-422886",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_reader_2020:*:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "acrobat_reader_dc",
            "product": {
              "name": "acrobat_reader_dc",
              "product_id": "CSAFPID-371567",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "adobe"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-39383",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39383",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39383.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39383"
    },
    {
      "cve": "CVE-2024-39422",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39422",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39422.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39422"
    },
    {
      "cve": "CVE-2024-39423",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39423",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39423.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39423"
    },
    {
      "cve": "CVE-2024-39424",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39424",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39424.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39424"
    },
    {
      "cve": "CVE-2024-39425",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Verification of Cryptographic Signature",
          "title": "CWE-347"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39425",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39425.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39425"
    },
    {
      "cve": "CVE-2024-39426",
      "cwe": {
        "id": "CWE-788",
        "name": "Access of Memory Location After End of Buffer"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Memory Location After End of Buffer",
          "title": "CWE-788"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39426",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39426.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-39426"
    },
    {
      "cve": "CVE-2024-41830",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41830",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41830.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41830"
    },
    {
      "cve": "CVE-2024-41831",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use After Free",
          "title": "CWE-416"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41831",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41831.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41831"
    },
    {
      "cve": "CVE-2024-41832",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41832",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41832.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41832"
    },
    {
      "cve": "CVE-2024-41833",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41833",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41833.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41833"
    },
    {
      "cve": "CVE-2024-41834",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41834",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41834.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41834"
    },
    {
      "cve": "CVE-2024-41835",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-422884",
          "CSAFPID-371567",
          "CSAFPID-1615953",
          "CSAFPID-422885",
          "CSAFPID-422886"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-41835",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-41835.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-422884",
            "CSAFPID-371567",
            "CSAFPID-1615953",
            "CSAFPID-422885",
            "CSAFPID-422886"
          ]
        }
      ],
      "title": "CVE-2024-41835"
    }
  ]
}

CERTFR-2024-AVI-0678

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Adobe. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Adobe	Acrobat	Acrobat 2020 versions antérieures à 20.005.30655
Adobe	Magento	Magento Open Source versions 2.4.5.x antérieures à 2.4.5-p9
Adobe	Acrobat	Acrobat DC versions antérieures à 24.002.21005
Adobe	Commerce	Commerce versions antérieures à 2.4.4-p10
Adobe	Commerce	Commerce versions 2.4.7.x antérieures à 2.4.7-p2
Adobe	Commerce	Commerce versions 2.4.6.x antérieures à 2.4.6-p7
Adobe	Commerce	Commerce versions 2.4.5.x antérieures à 2.4.5-p9
Adobe	Magento	Magento Open Source versions 2.4.6.x antérieures à 2.4.6-p7
Adobe	Acrobat	Acrobat 2024 versions antérieures à 24.001.30159
Adobe	Magento	Magento Open Source versions 2.4.7.x antérieures à 2.4.7-p2
Adobe	Magento	Magento Open Source versions antérieures à 2.4.4-p10
Adobe	Acrobat Reader	Acrobat Reader DC versions antérieures à 24.002.21005
Adobe	Acrobat Reader	Acrobat Reader 2020 versions antérieures à 20.005.30655

References

Title

Publication Time

fkie_cve-2024-39425

Vulnerability from fkie_nvd

Published

2024-08-14 15:15

Modified

2024-08-15 17:17

Severity ?

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@adobe.com	https://helpx.adobe.com/security/products/acrobat/apsb24-57.html	Vendor Advisory

Impacted products

Vendor	Product	Version
adobe	acrobat	*
adobe	acrobat	*
adobe	acrobat_dc	*
adobe	acrobat_reader	*
adobe	acrobat_reader_dc	*
apple	macos	-
microsoft	windows	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "B9311FEC-D9CC-421C-8E5E-8131E460FC42",
              "versionEndExcluding": "20.005.30655",
              "versionStartIncluding": "20.001.30005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "1A09E4B8-DB3B-45EC-B441-2C9549D299B1",
              "versionEndExcluding": "24.001.30159",
              "versionStartIncluding": "24.001.20604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
              "matchCriteriaId": "D555A6CB-9EDF-4CA2-B8E5-04A9D212FD8B",
              "versionEndExcluding": "24.002.21005",
              "versionStartIncluding": "15.008.20082",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "883444C8-35EB-4BDF-A14C-C4C5BF97239A",
              "versionEndExcluding": "20.005.30655",
              "versionStartIncluding": "20.001.3005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
              "matchCriteriaId": "9CE03784-4780-4313-A27A-37B265BF3F9D",
              "versionEndExcluding": "24.002.21005",
              "versionStartIncluding": "15.008.20082",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high."
    },
    {
      "lang": "es",
      "value": " Las versiones de Acrobat Reader 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 y anteriores se ven afectadas por una vulnerabilidad de condici\u00f3n de ejecuci\u00f3n de Time-of-check Time-of-use (TOCTOU) que podr\u00eda provocar una escalada de privilegios. La explotaci\u00f3n de este problema requiere acceso local con pocos privilegios al sistema afectado y la complejidad del ataque es alta."
    }
  ],
  "id": "CVE-2024-39425",
  "lastModified": "2024-08-15T17:17:59.783",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "psirt@adobe.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-08-14T15:15:25.883",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "psirt@adobe.com",
      "type": "Primary"
    }
  ]
}

ghsa-8p32-h9gr-3vrr

Vulnerability from github

Published

2024-08-14 15:31

Modified

2024-08-14 15:31

Severity ?

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-14T15:15:25Z",
    "severity": "HIGH"
  },
  "details": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.",
  "id": "GHSA-8p32-h9gr-3vrr",
  "modified": "2024-08-14T15:31:18Z",
  "published": "2024-08-14T15:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2024-39425 (GCVE-0-2024-39425)

Vulnerability from cvelistv5

Vulnerability from cnvd

Vulnerability from csaf_certbund

Vulnerability from csaf_certbund

Vulnerability from csaf_ncscnl

Vulnerability from csaf_ncscnl

Vulnerability from certfr_avis

Solutions

Vulnerability from fkie_nvd

Vulnerability from github

Tags

Sightings

Nomenclature