CVE-2017-16380

High

Published: 09/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability in Adobe Acrobat and Reader allows for a security bypass related to file-type extensions. Users can open files with extensions that are neither on the blacklist nor the whitelist after a warning prompt is displayed.

Risk Assessment

Organizations may be exposed to opening malicious files, potentially leading to data leaks or system infections. This vulnerability poses a risk to the security of documents and user data.

Recommendation

It is recommended to update Adobe Acrobat and Reader to the latest version to mitigate this vulnerability. Additionally, policies should be implemented to restrict opening files from unknown sources.

Other vulnerabilities in Adobe Acrobat and Reader (wersje: 2017.012.20098 i wcześniejsze, 2017.011.30066 i wcześniejsze, 2015.006.30355 i wcześniejsze, 11.0.22 i wcześniejsze)

CVE-2017-16399High
An issue exists in Adobe Acrobat and Reader related to untrusted pointer dereference in the XPS parsing module. An attacker can craft input that leads to reading memory outside the process address space, potentially exposing sensitive data.

Original NVD description (English source)

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of a security bypass vulnerability for a certain file-type extension. Acrobat maintains both a blacklist and whitelist (the user can specify an allowed attachment). However, any file extensions that are neither on the blacklist nor the whitelist can still be opened after displaying a warning prompt.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS