PT-2018-16592 · Adobe · Acrobat Reader
Published
2018-02-13
·
Updated
2018-07-12
·
CVE-2018-4886
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Adobe Acrobat Reader versions 2018.009.20050 and earlier
Adobe Acrobat Reader versions 2017.011.30070 and earlier
Adobe Acrobat Reader versions 2015.006.30394 and earlier
Description
The issue occurs due to computation that reads data past the end of the target buffer in the image conversion engine when processing Enhanced Metafile Format (EMF) data related to handling of bitmap rectangles. This can lead to sensitive data exposure. A successful attack can also allow attackers to execute code remotely.
Recommendations
For Adobe Acrobat Reader versions 2018.009.20050 and earlier, update to a version later than 2018.009.20050 to resolve the issue.
For Adobe Acrobat Reader versions 2017.011.30070 and earlier, update to a version later than 2017.011.30070 to resolve the issue.
For Adobe Acrobat Reader versions 2015.006.30394 and earlier, update to a version later than 2015.006.30394 to resolve the issue.
As a temporary workaround, consider disabling the image conversion engine when processing EMF data to minimize the risk of exploitation.
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Acrobat Reader