Adobe has addressed 14 vulnerabilities in its Acrobat products, including critical flaws that can be exploited by attackers for arbitrary code execution.
Adobe has addressed 14 vulnerabilities in its Acrobat products, including critical flaws that can be exploited by attackers for arbitrary code execution.
The vulnerabilities impact the Windows and macOS versions of Acrobat DC, Acrobat Reader DC, Acrobat 2020, Acrobat Reader 2020, Acrobat 2017, and Acrobat Reader 2017.
“Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.” reads the advisory published by the company.
The following four vulnerabilities have been rated as critical severity:
- CVE-2020-24435: A Heap-based buffer overflow that can lead an arbitrary code execution in the context of the targeted user.
- CVE-2020-24436: An Out-of-bounds write that can lead an arbitrary code execution in the context of the targeted user.
- CVE-2020-24430, CVE-2020-24437: Use-after-free issues that can lead an arbitrary code execution in the context of the targeted user.
Adobe addressed six important flaws rated as important, tracked as CVE-2020-24433, CVE-2020-24432, CVE-2020-24429, CVE-2020-24427, CVE-2020-24431, CVE-2020-24428, that can be exploited for local privilege escalation, information disclosure, DLL injection, and JavaScript code execution.
The flaws have been described as improper access control, improper input validation, signature verification bypass, security feature bypass, and race condition.
The software giant also fixed moderate-severity vulnerabilities (CVE-2020-24439, CVE-2020-24426, CVE-2020-24434, CVE-2020-24438) that can lead to information disclosure.
The flaws were reported by independent researchers and experts from Cisco Talos, Computest, Danish Cyber Defence, Qihoo 360, Star Lab and Ruhr University Bochum, and Tencent,.
The good news is that Adobe is not aware of any attacks in the wild exploiting these vulnerabilities and does not expect them to be exploited soon.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Adobe)
[adrotate banner=”5″]
[adrotate banner=”13″]
