CVE-2020-24433

CVE-2020-24433 is a local privilege-escalation in Adobe Acrobat Reader DC (installer component) affecting versions 2017.011.30175 and earlier, 2020.012.20048 and earlier, and 2020.001.30005 and earlier. The flaw can allow a non-admin user to delete arbitrary files and potentially execute code as ...

CVE-2020-24438 Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious...

CVE-2020-24434 Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information Disclosure

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR...

CVE-2020-24434

CVE-2020-24434 is an out-of-bounds read vulnerability in Adobe Acrobat/Reader (Acrobat Reader DC and Acrobat Pro DC) affecting versions such as 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier. The root cause is an out-of-bounds read that could disclose sensi...

CVE-2020-24435

CVE-2020-24435 is a heap-based buffer overflow in Adobe Acrobat Reader DC (submitForm) affecting 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier. Exploitation requires user interaction: a victim must open a crafted PDF, potentially enabling arbitrary code ex...

CVE-2020-24430 Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user...

CVE-2020-24429

CVE-2020-24429 concerns macOS Adobe Acrobat Reader DC where a signature verification bypass could enable local privilege escalation. Affected are macOS builds such as 2017.011.30175 and earlier, and newer 2020.x versions listed in the entry. Exploitation requires user interaction (opening a malic...

CVE-2020-24431 Acrobat Reader DC for macOS Dynamic Library Injection Vulnerability

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interactio...

CVE-2020-24437

CVE-2020-24437 affects Adobe Acrobat/Reader DC: versions 2020.012.20048 and earlier, 2020.001.30005 and earlier, and 2017.011.30175 and earlier are vulnerable to a use-after-free in the processing of Format event actions, potentially allowing arbitrary code execution under the current user. Explo...

CVE-2020-24437 Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation ...

CVE-2020-24426

CVE-2020-24426 affects Adobe Acrobat/Reader: out-of-bounds read in Acrobat/Reader components leading to information disclosure; exploitation requires user interaction (victim opens a malicious file) and could bypass ASLR. Affected products include Acrobat Reader DC versions 2020.012.20048 and ear...

CVE-2020-24439: Improper Verification of Cryptographic Signature

Acrobat Reader DC for macOS versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader upda...

CVE-2020-24433: Improper Access Control

Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary...

CVE-2020-24434: Out-of-bounds Read

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR...

CVE-2020-24430: Use After Free

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user...

CVE-2020-24436: Out-of-bounds Write

Acrobat Pro DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute...

CVE-2020-24432: Improper Input Validation

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier and Adobe Acrobat Pro DC 2017.011.30175 and earlier are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the...

CVE-2020-24435: Heap-based Buffer Overflow

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the current user. Exploitatio...

CVE-2020-24428: Time-of-check Time-of-use (TOCTOU) Race Condition

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier for macOS are affected by a time-of-check time-of-use TOCTOU race condition vulnerability that could result in local privilege escalation. Exploitation of this issue requires user...

CVE-2020-24429: Improper Verification of Cryptographic Signature

Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must op...