CVE-2017-16399

High

Published: 09/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue exists in Adobe Acrobat and Reader related to untrusted pointer dereference in the XPS parsing module. An attacker can craft input that leads to reading memory outside the process address space, potentially exposing sensitive data.

Risk Assessment

The organization may be at risk of sensitive information exposure, which could lead to privacy breaches and data security issues.

Recommendation

It is recommended to update Adobe Acrobat and Reader to the latest version to mitigate the risk associated with this vulnerability.

Other vulnerabilities in Adobe Acrobat and Reader (wersje: 2017.012.20098 i wcześniejsze, 2017.011.30066 i wcześniejsze, 2015.006.30355 i wcześniejsze, 11.0.22 i wcześniejsze)

CVE-2017-16380High
A vulnerability in Adobe Acrobat and Reader allows for a security bypass related to file-type extensions. Users can open files with extensions that are neither on the blacklist nor the whitelist after a warning prompt is displayed.

Original NVD description (English source)

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This issue is due to an untrusted pointer dereference in the XPS parsing module. In this scenario, the input is crafted in a way that the computation results in pointers to memory locations that do not belong to the relevant process address space. The dereferencing operation is a read operation, and an attack can result in sensitive data exposure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS