PT-2020-6494 · Adobe · Acrobat+1
Published
2020-12-09
·
Updated
2021-09-22
·
CVE-2020-29075
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:C/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Adobe Acrobat versions prior to 2020.013.20066
Adobe Acrobat versions prior to 2020.001.30010
Adobe Acrobat versions prior to 2017.011.30180
Adobe Reader versions prior to 2020.013.20066
Adobe Reader versions prior to 2020.001.30010
Adobe Reader versions prior to 2017.011.30180
Description
The issue is related to insufficient input validation, which could allow a remote attacker to gain unauthorized access to protected information in the context of the current user using a specially crafted PDF file. This vulnerability could enable an attacker to get a DNS interaction and track if the user has opened or closed a PDF file when loaded from the filesystem without a prompt. User interaction is required to exploit this vulnerability.
Recommendations
For Adobe Acrobat versions prior to 2020.013.20066, update to a version later than 2020.013.20066.
For Adobe Acrobat versions prior to 2020.001.30010, update to a version later than 2020.001.30010.
For Adobe Acrobat versions prior to 2017.011.30180, update to a version later than 2017.011.30180.
For Adobe Reader versions prior to 2020.013.20066, update to a version later than 2020.013.20066.
For Adobe Reader versions prior to 2020.001.30010, update to a version later than 2020.001.30010.
For Adobe Reader versions prior to 2017.011.30180, update to a version later than 2017.011.30180.
Fix
Information Disclosure
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Acrobat
Reader