PT-2018-1165 · Adobe · Acrobat Reader
Publicado
2018-02-13
·
Atualizado
2020-08-24
·
CVE-2018-4872
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Adobe Acrobat Reader versions 2018.009.20050 and earlier
Adobe Acrobat Reader versions 2017.011.30070 and earlier
Adobe Acrobat Reader versions 2015.006.30394 and earlier
Description
The issue is a security bypass vulnerability that leads to a sandbox escape, specifically due to the way a cross call is handled. This vulnerability exists in the way cross calls are processed, allowing a remote attacker to potentially escape the isolated environment. The vulnerability is related to errors in handling cross calls in Adobe Acrobat and Reader.
Recommendations
For Adobe Acrobat Reader versions 2018.009.20050 and earlier, update to a version later than 2018.009.20050 to resolve the issue.
For Adobe Acrobat Reader versions 2017.011.30070 and earlier, update to a version later than 2017.011.30070 to resolve the issue.
For Adobe Acrobat Reader versions 2015.006.30394 and earlier, update to a version later than 2015.006.30394 to resolve the issue.
As a temporary workaround, consider restricting the handling of cross calls until a patch is available.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Acrobat Reader