CVE-2017-16385in critical feed
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.303…
Published 8 y ago · modified 4 mo ago · JSON
Summary
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in TIFF parsing during XPS conversion. Crafted TIFF image input causes a mismatch between allocated buffer size and the access allowed by the computation. If an attacker can adequately control the accessible memory then this vulnerability can be leveraged to achieve arbitrary code execution.
Exploit prediction (EPSS)
12.85% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- n/a Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securitytracker.com /id/1039791 · vdb-entry, x_refsource_SECTRACK, x_transferred
- helpx.adobe.com /security/products/acrobat/apsb17-36.html · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/101831 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-16385
- NVD: CVE-2017-16385
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.