Adobe Reader < 20.005.30774 / 25.001.20529 Multiple Vulnerabilities (APSB25-57) (macOS)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(238099);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/29");

  script_cve_id(
    "CVE-2025-43550",
    "CVE-2025-43573",
    "CVE-2025-43574",
    "CVE-2025-43575",
    "CVE-2025-43576",
    "CVE-2025-43577",
    "CVE-2025-43578",
    "CVE-2025-43579",
    "CVE-2025-47111",
    "CVE-2025-47112"
  );
  script_xref(name:"IAVA", value:"2025-A-0408-S");

  script_name(english:"Adobe Reader < 20.005.30774 / 25.001.20529 Multiple Vulnerabilities (APSB25-57) (macOS)");

  script_set_attribute(attribute:"synopsis", value:
"The version of Adobe Reader installed on the remote macOS host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Reader installed on the remote macOS host is a version prior to 20.005.30774 or 25.001.20529. It
is, therefore, affected by multiple vulnerabilities.

  - Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a Use After
    Free vulnerability that could result in arbitrary code execution in the context of the current user.
    Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2025-43550, CVE-2025-43573, CVE-2025-43574, CVE-2025-43576, CVE-2025-43577)

  - Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-
    bounds write vulnerability that could result in arbitrary code execution in the context of the current
    user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
    (CVE-2025-43575)

  - Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an out-of-
    bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage
    this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user
    interaction in that a victim must open a malicious file. (CVE-2025-43578, CVE-2025-47112)

  - Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by a NULL
    Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could
    exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this
    issue requires user interaction in that a victim must open a malicious file. (CVE-2025-47111)

  - Acrobat Reader versions 24.001.30235, 20.005.30763, 25.001.20521 and earlier are affected by an
    Information Exposure vulnerability that could result in a Security feature bypass. An attacker could
    leverage this vulnerability to gain unauthorized access to sensitive information. Exploitation of this
    issue does not require user interaction. (CVE-2025-43579)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/acrobat/apsb25-57.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Reader version 20.005.30774 / 25.001.20529 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-43577");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(125, 200, 416, 476, 787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_adobe_reader_installed.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "installed_sw/Adobe Reader");

  exit(0);
}

include('vcf_extras.inc');

get_kb_item_or_exit('Host/local_checks_enabled');
os = get_kb_item('Host/MacOSX/Version');
if (empty_or_null(os)) audit(AUDIT_OS_NOT, 'Mac OS X');

var app_info = vcf::get_app_info(app:'Adobe Reader');

# vcf::adobe_reader::check_version_and_report will
# properly separate tracks when checking constraints.
# x.y.30zzz = DC Classic
# x.y.20zzz = DC Continuous
var constraints = [
  { 'min_version' : '20.1', 'max_version' : '20.005.30763', 'fixed_version' : '20.005.30774', 'track' : 'DC Classic' },
  { 'min_version' : '15.7', 'max_version' : '25.001.20521', 'fixed_version' : '25.001.20529', 'fixed_display' : '25.001.20529 (Mac)', 'track' : 'DC Continuous' }
];
vcf::adobe_acrobat::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    max_segs:3,
    severity:SECURITY_HOLE
);