PT-2020-5007 · Adobe · Acrobat Pro Dc+1

Kimiya · Published 2020-11-03 · Updated 2021-09-16 · CVE-2020-24436

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Pro DC versions 2020.012.20048 and earlier Adobe Acrobat Pro DC versions 2020.001.30005 and earlier Adobe Acrobat Pro DC versions 2017.011.30175 and earlier Adobe Reader (affected versions not specified)

Description The issue is related to an out-of-bounds write vulnerability in memory, which can be exploited by a remote attacker to execute arbitrary code in the context of the current user. This can be achieved by using a specially crafted file, and user interaction is required, as the victim must open a malicious document.

Recommendations For Adobe Acrobat Pro DC versions 2020.012.20048 and earlier, update to a version later than 2020.012.20048 to resolve the issue. For Adobe Acrobat Pro DC versions 2020.001.30005 and earlier, update to a version later than 2020.001.30005 to resolve the issue. For Adobe Acrobat Pro DC versions 2017.011.30175 and earlier, update to a version later than 2017.011.30175 to resolve the issue. For Adobe Reader, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2020-05592

CVE-2020-24436

ZDI-20-1355

Affected Products

Acrobat Pro Dc

Reader

References · 7

• https://zerodayinitiative.com/advisories/ZDI-20-1355 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb20-67.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24436 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05592 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/659147 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24436 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24436 · Note