CVE-2017-16396
HighSummary
A vulnerability exists in Adobe Acrobat and Reader related to improper buffer access in the TIFF processing module. Crafted input can cause a mismatch between allocated buffer size and allowed access, potentially leading to arbitrary code execution.
Risk Assessment
An attacker with control over accessible memory could exploit this vulnerability to execute malicious code, posing a significant security risk to systems using these versions of the software.
Recommendation
It is recommended to update Adobe Acrobat and Reader to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access.
Other vulnerabilities in Adobe Acrobat and Reader (2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, 11.0.22 and earlier)
See all- CVE-2017-16392High
A vulnerability exists in Adobe Acrobat and Reader related to improper buffer access in the JPEG processing module. Crafted input with an unexpected JPEG file segment size can lead to a mismatch between allocated buffer size and allowed access, potentially enabling arbitrary code execution.
- CVE-2017-16362High
A vulnerability exists in Adobe Acrobat and Reader related to an out of bounds read in the MakeAccesible plugin when handling font data. This can lead to memory access violations, potentially resulting in code corruption or information leaks.
- CVE-2017-16360High
A use after free vulnerability exists in Adobe Acrobat and Reader in the MakeAccessible plugin, which can lead to unintended memory access. Exploiting this vulnerability may result in arbitrary code execution.
Original NVD description (English source)
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in the TIFF processing module. Crafted input causes a mismatch between allocated buffer size and the access allowed by the computation. If an attacker can adequately control the accessible memory then this vulnerability can be leveraged to achieve arbitrary code execution.