CVE Vulnerability Catalog

An issue exists in Adobe Acrobat and Reader related to untrusted pointer dereference when handling number format dictionary entries. This can allow an attacker to access sensitive data.

A vulnerability exists in Adobe Acrobat and Reader caused by a buffer over-read in the module handling character codes for certain textual representations. Invalid input leads to computations that point to memory locations outside the valid buffer areas.

A vulnerability exists in Adobe Acrobat and Reader related to an out of bounds read in the MakeAccesible plugin when handling font data. This can lead to memory access violations, potentially resulting in code corruption or information leaks.

A use after free vulnerability exists in Adobe Acrobat and Reader in the MakeAccessible plugin, which can lead to unintended memory access. Exploiting this vulnerability may result in arbitrary code execution.

A use-after-free vulnerability was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe InDesign 12.1.0 and earlier versions. Successful exploitation could lead to arbitrary code execution.

An issue was discovered in Adobe DNG Converter 9.12.1 and earlier versions related to memory corruption. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe Shockwave 12.2.9.199 and earlier. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability exists in Adobe Acrobat and Reader that could be exploited to execute arbitrary code. This affects versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.

A Server-Side Request Forgery (SSRF) vulnerability was discovered in Adobe Connect 9.6.2 and earlier versions, which could be abused to bypass network access controls.

A use after free vulnerability was discovered in Adobe Flash Player 27.0.0.183 and earlier versions in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access, potentially leading to code corruption, control-flow hijack, or an information leak attack.

A use after free vulnerability was discovered in Adobe Flash Player 27.0.0.183 and earlier versions in the Primetime SDK. The mismatch between an old and a new object can provide an attacker with unintended memory access, potentially leading to code corruption, control-flow hijack, or an information leak attack.

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions related to an integer overflow that leads to reading data past the end of the target buffer. The use of an invalid pointer during access to internal data structure fields causes this vulnerability.

In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. An attacker sending arbitrary network traffic to the monitored port could prevent Packetbeat from properly logging other PostgreSQL traffic.

Version 1.2.0.300 of Kaspersky Embedded Systems Security contains a driver bug that leads to kernel memory corruption, potentially resulting in local privilege escalation.

In OTRS versions 6.0.x up to and including 6.0.1, 5.0.x up to and including 5.0.24, and 4.0.x up to and including 4.0.26, an attacker logged in as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web server user.

CVE-2017-10906 describes an escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40. This may allow an attacker to change the terminal UI or execute arbitrary commands on the device.