Mark Vincent Yason

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader DC versions 2021.005.20060 and earlier Adobe Acrobat Reader DC versions 2020.004.30006 and earlier Adobe Acrobat Reader DC versions 2017.011.30199 and earlier **Description** A use-after-free vulnerability exists when processing AcroForm listbox, which could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. **Recommendations** For Adobe Acrobat Reader DC versions 2021.005.20060 and earlier, update to a version later than 2021.005.20060 to resolve the issue. For Adobe Acrobat Reader DC versions 2020.004.30006 and earlier, update to a version later than 2020.004.30006 to resolve the issue. For Adobe Acrobat Reader DC versions 2017.011.30199 and earlier, update to a version later than 2017.011.30199 to resolve the issue. As a temporary workaround, consider avoiding the use of AcroForm listbox until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader DC versions 2021.005.20060 and earlier Adobe Acrobat Reader DC versions 2020.004.30006 and earlier Adobe Acrobat Reader DC versions 2017.011.30199 and earlier **Description** A use-after-free vulnerability exists when processing AcroForm fields, potentially resulting in arbitrary code execution in the context of the current user. This issue requires user interaction, where the target must visit a malicious page or open a malicious file to exploit the vulnerability. **Recommendations** For Adobe Acrobat Reader DC versions 2021.005.20060 and earlier, update to a version later than 2021.005.20060 to resolve the issue. For Adobe Acrobat Reader DC versions 2020.004.30006 and earlier, update to a version later than 2020.004.30006 to resolve the issue. For Adobe Acrobat Reader DC versions 2017.011.30199 and earlier, update to a version later than 2017.011.30199 to resolve the issue. As a temporary workaround, consider avoiding the use of AcroForm fields until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader DC versions 2017.011.30175 through 2020.012.20048 Adobe Acrobat versions (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This could allow a remote attacker to disclose protected information using a specially crafted file. **Recommendations** For Adobe Acrobat Reader DC versions 2017.011.30175 through 2020.012.20048, update to a version later than 2020.012.20048 to resolve the issue. For Adobe Acrobat, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat Reader DC versions 2020.012.20048 and earlier Adobe Acrobat Reader DC versions 2020.001.30005 and earlier Adobe Acrobat Reader DC versions 2017.011.30175 and earlier **Description** The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This vulnerability allows a remote attacker to disclose protected information. **Recommendations** For Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, update to a version later than 2020.012.20048 to resolve the issue. For Adobe Acrobat Reader DC versions 2020.001.30005 and earlier, update to a version later than 2020.001.30005 to resolve the issue. For Adobe Acrobat Reader DC versions 2017.011.30175 and earlier, update to a version later than 2017.011.30175 to resolve the issue. As a temporary workaround, consider avoiding the use of `ID` parameter in affected API endpoints until a patch is available. Restrict access to malicious files to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat versions prior to 2020.009.20074 Adobe Acrobat versions 2017.011.30171 and earlier Adobe Acrobat versions 2015.006.30523 and earlier Adobe Reader versions prior to 2020.009.20074 Adobe Reader versions 2017.011.30171 and earlier Adobe Reader versions 2015.006.30523 and earlier Description: The issue is related to a use-after-free vulnerability in Adobe Acrobat and Reader, which can be exploited by a remote attacker to execute arbitrary code. This vulnerability is associated with the misuse of memory after it has been freed. Recommendations: For Adobe Acrobat and Reader versions 2020.009.20074 and earlier, update to a version later than 2020.009.20074. For Adobe Acrobat and Reader versions 2017.011.30171 and earlier, update to a version later than 2017.011.30171. For Adobe Acrobat and Reader versions 2015.006.30523 and earlier, update to a version later than 2015.006.30523. As a temporary workaround, consider restricting the use of Adobe Acrobat and Reader until a patch is available.