CVE-2017-16360
HighSummary
A use after free vulnerability exists in Adobe Acrobat and Reader in the MakeAccessible plugin, which can lead to unintended memory access. Exploiting this vulnerability may result in arbitrary code execution.
Risk Assessment
Organizations may face serious threats such as code corruption, control-flow hijacking, or information leakage. Successful exploitation could lead to full system compromise.
Recommendation
It is recommended to update Adobe Acrobat and Reader to the latest version to mitigate this vulnerability. Additionally, monitor systems for unauthorized activities.
Other vulnerabilities in Adobe Acrobat and Reader (2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier)
See all- CVE-2017-16396High
A vulnerability exists in Adobe Acrobat and Reader related to improper buffer access in the TIFF processing module. Crafted input can cause a mismatch between allocated buffer size and allowed access, potentially leading to arbitrary code execution.
- CVE-2017-16392High
A vulnerability exists in Adobe Acrobat and Reader related to improper buffer access in the JPEG processing module. Crafted input with an unexpected JPEG file segment size can lead to a mismatch between allocated buffer size and allowed access, potentially enabling arbitrary code execution.
- CVE-2017-16362High
A vulnerability exists in Adobe Acrobat and Reader related to an out of bounds read in the MakeAccesible plugin when handling font data. This can lead to memory access violations, potentially resulting in code corruption or information leaks.
Original NVD description (English source)
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the MakeAccessible plugin, when creating an internal data structure. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.