PT-2017-1170 · Adobe · Acrobat Reader

Published 2017-01-05 · Updated 2017-01-18 · CVE-2017-2949

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier

Description The issue is caused by a heap buffer overflow vulnerability in the XSLT engine of Adobe Acrobat and Reader. This vulnerability could allow a remote attacker to execute arbitrary code. The vulnerability is related to the XSLT processing and can be exploited through a heap-based buffer overflow, which may lead to remote code execution.

Recommendations For Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier, update to a version that is not affected by this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-00274

CVE-2017-2949

ZDI-17-005

ZDI-17-006

ZDI-17-007

ZDI-17-008

ZDI-17-009

ZDI-17-011

ZDI-17-012

ZDI-17-013

ZDI-17-015

ZDI-17-016

ZDI-17-017

ZDI-17-018

ZDI-17-019

ZDI-17-020

ZDI-17-028

ZDI-17-029

Affected Products

Acrobat Reader

References · 39

• https://zerodayinitiative.com/advisories/ZDI-17-012 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-016 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-017 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-006 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-029 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2949 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-013 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-020 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-018 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-007 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-005 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-008 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-028 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb17-01.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2949 · Vendor Advisory