PT-2020-5010 · Adobe · Acrobat+1

Mark Vincent Yason + 1 · Published 2020-11-03 · Updated 2021-09-08 · CVE-2020-24438

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC versions 2017.011.30175 through 2020.012.20048 Adobe Acrobat versions (affected versions not specified)

Description The issue is related to a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction, where a victim must open a malicious file. This could allow a remote attacker to disclose protected information using a specially crafted file.

Recommendations For Adobe Acrobat Reader DC versions 2017.011.30175 through 2020.012.20048, update to a version later than 2020.012.20048 to resolve the issue. For Adobe Acrobat, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2020-05595

CVE-2020-24438

ZDI-20-1357

Affected Products

Acrobat

Acrobat Reader

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-24438 · Security Note
• https://helpx.adobe.com/security/products/acrobat/apsb20-67.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05595 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1357 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24438 · Vendor Advisory
• https://t.me/cvenotify/7642 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24438 · Note