PT-2017-14396 · Adobe · Acrobat

Published 2017-11-14 · Updated 2018-02-12 · CVE-2017-16383

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to 2017.012.20098 Adobe Acrobat versions prior to 2017.011.30066 Adobe Acrobat versions prior to 2015.006.30355 Adobe Acrobat versions prior to 11.0.22

Description The issue is related to a heap overflow vulnerability when processing a JPEG file embedded within an XPS document. This allows attackers to execute code remotely. The vulnerability is triggered by parsing a specifically crafted JPEG file, which leads to a heap-based buffer overflow.

Recommendations For versions prior to 2017.012.20098, update to a version later than 2017.012.20098 to resolve the issue. For versions prior to 2017.011.30066, update to a version later than 2017.011.30066 to resolve the issue. For versions prior to 2015.006.30355, update to a version later than 2015.006.30355 to resolve the issue. For versions prior to 11.0.22, update to a version later than 11.0.22 to resolve the issue. As a temporary workaround, consider disabling the processing of JPEG files embedded within XPS documents until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-16383

ZDI-17-900

ZDI-18-157

Affected Products

Acrobat

References · 8

• https://zerodayinitiative.com/advisories/ZDI-17-900 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-157 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16383 · Vendor Advisory
• https://helpx.adobe.com/security/products/acrobat/apsb17-36.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16383 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16383 · Note
• http://securitytracker.com/id/1039791 · Note
• http://securityfocus.com/bid/101823 · Note