PT-2021-3422 · Adobe · Acrobat Reader

Published 2021-05-11 · Updated 2021-09-15 · CVE-2021-28558

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader DC versions 2021.001.20150 and earlier Adobe Acrobat Reader DC versions 2020.001.30020 and earlier Adobe Acrobat Reader DC versions 2017.011.30194 and earlier

Description The issue is caused by a heap-based buffer overflow in the PDFLibTool component. This allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user by exploiting the vulnerability. The exploitation requires user interaction, where a victim must open a malicious file.

Recommendations For Adobe Acrobat Reader DC versions 2021.001.20150 and earlier, update to a version later than 2021.001.20150 to resolve the issue. For Adobe Acrobat Reader DC versions 2020.001.30020 and earlier, update to a version later than 2020.001.30020 to resolve the issue. For Adobe Acrobat Reader DC versions 2017.011.30194 and earlier, update to a version later than 2017.011.30194 to resolve the issue. As a temporary workaround, consider avoiding the use of the PDFLibTool component until a patch is available.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2021-03274

CVE-2021-28558

Affected Products

Acrobat Reader

References · 8

• https://helpx.adobe.com/security/products/acrobat/apsb21-29.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28558 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/664618 · Security Note
• https://bdu.fstec.ru/vul/2021-03274 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28558 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28558 · Note
• https://t.me/cibsecurity/28242 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021051143 · Note