CVE-2020-24435

CVE-2020-24435 is a heap-based buffer overflow in Adobe Acrobat Reader DC (submitForm) affecting 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier. Exploitation requires user interaction: a victim must open a crafted PDF, potentially enabling arbitrary code ex...

CVE-2020-24432

CVE-2020-24432 applies to Adobe Acrobat/Reader affected by an improper input validation vulnerability that could allow arbitrary JavaScript execution in the context of the current user. Affected products include Acrobat Reader DC 2020.012.20048 and earlier, 2020.001.30005 and earlier, 2017.011.30...

CVE-2020-24432 Acrobat Reader DC Arbitrary JavaScript Execution in PDF Documents

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier and Adobe Acrobat Pro DC 2017.011.30175 and earlier are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the...

CVE-2020-24430 Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user...

CVE-2020-24430

CVE-2020-24430 is part of Adobe APSB20-67. Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier are affected by a use-after-free vulnerability when handling malicious JavaScript, which could result in arbitrary code execution in the con...

CVE-2020-24429

CVE-2020-24429 concerns macOS Adobe Acrobat Reader DC where a signature verification bypass could enable local privilege escalation. Affected are macOS builds such as 2017.011.30175 and earlier, and newer 2020.x versions listed in the entry. Exploitation requires user interaction (opening a malic...

CVE-2020-24429 Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must op...

CVE-2020-24431

CVE-2020-24431 affects Adobe Acrobat Reader DC for macOS. A security feature bypass could allow dynamic library code injection by the Adobe Reader process. Exploitation requires user interaction (victim must open a malicious file). Affected versions include macOS builds of Acrobat Reader DC 2017....

CVE-2020-24431 Acrobat Reader DC for macOS Dynamic Library Injection Vulnerability

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interactio...

CVE-2020-24428

CVE-2020-24428 (Acrobat Reader DC for macOS) is a TOCTOU race condition affecting 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier. It could lead to local privilege escalation; exploitation requires a user to open a malicious file. A fix is available under Ad...

CVE-2020-24428 Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier for macOS are affected by a time-of-check time-of-use TOCTOU race condition vulnerability that could result in local privilege escalation. Exploitation of this issue requires user...

CVE-2020-24437

CVE-2020-24437 affects Adobe Acrobat/Reader DC: versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier are vulnerable to a use-after-free in the processing of Format event actions, potentially allowing arbitrary code execution under the current user. Explo...

CVE-2020-24437 Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation ...

CVE-2020-24427

The CVE-2020-24427 entry describes an input validation vulnerability in Adobe Acrobat/Reader when decoding a crafted codec, which could lead to disclosure of sensitive memory and allow bypassing ASLR. Affected products include Acrobat Reader versions 2020.012.20048 and earlier, 2020.001.30005 and...

CVE-2020-24427 Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information Disclosure

Acrobat Reader versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by an input validation vulnerability when decoding a crafted codec that could result in the disclosure of sensitive memory. An attacker could leverage this vulnerability to...

CVE-2020-24426

CVE-2020-24426 affects Adobe Acrobat/Reader: out-of-bounds read in Acrobat/Reader components leading to information disclosure; exploitation requires user interaction (victim opens a malicious file) and could bypass ASLR. Affected products include Acrobat Reader DC versions 2020.012.20048 and ear...

CVE-2020-24426 Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR...

Vulnerability Spotlight: Multiple JavaScript vulnerabilities in Adobe Acrobat Reader

Aleksandar Nikolic of Cisco Talos discovered these vulnerabilities. Blog by Joe Marshall Cisco Talos recently discovered an heap buffer overflow and a use after free vulnerability in Adobe Acrobat Reader. Adobe Acrobat Reader is one of the most popular and feature-rich PDF readers on the market. ...

Adobe Acrobat < 2017.011.30180 / 2020.001.30010 / 2020.013.20064 Multiple Vulnerabilities (APSB20-67) (macOS)

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 2017.011.30180, 2020.001.30010, or 2020.013.20064. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 a...

Adobe Acrobat Reader DC JavaScript submitForm heap buffer overflow redux

Talos Vulnerability Report TALOS-2020-1157 Adobe Acrobat Reader DC JavaScript submitForm heap buffer overflow redux November 5, 2020 CVE Number CVE-2020-24435 SUMMARY A specific JavaScript code embedded in a PDF file can lead to out of bounds memory access when opening a PDF document in Adobe...