PT-2022-2371 · Foxit+1 · Foxit Pdf Reader+2

Published 2022-01-11 · Updated 2022-01-21 · CVE-2021-44740

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Adobe Acrobat versions prior to 2020 Adobe Acrobat Reader versions prior to 2020 Adobe Acrobat 2017 Adobe Acrobat Reader 2017 Adobe Acrobat 2020 versions prior to 21.007.20099 Adobe Acrobat Reader 2020 versions prior to 21.007.20099 Adobe Acrobat Reader DC versions prior to 21.007.20099 Adobe Acrobat Reader DC version 20.004.30017 and earlier Adobe Acrobat Reader DC version 17.011.30204 and earlier Foxit PDF Reader version 11.1.0.52543

Description The issue is related to a null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction, where a victim must open a malicious file.

Recommendations For Adobe Acrobat 2017, update to a version later than 2017 to resolve the issue. For Adobe Acrobat Reader 2017, update to a version later than 2017 to resolve the issue. For Adobe Acrobat 2020, update to version 21.007.20099 or later to resolve the issue. For Adobe Acrobat Reader 2020, update to version 21.007.20099 or later to resolve the issue. For Adobe Acrobat Reader DC version 20.004.30017 and earlier, update to version 21.007.20099 or later to resolve the issue. For Adobe Acrobat Reader DC version 17.011.30204 and earlier, update to version 21.007.20099 or later to resolve the issue. For Foxit PDF Reader version 11.1.0.52543, update to a version later than 11.1.0.52543 to resolve the issue. As a temporary workaround, consider avoiding the use of specially crafted files to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2022-02709

CVE-2021-44740

Affected Products

Acrobat

Acrobat Reader

Foxit Pdf Reader

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-44740 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44740 · Vendor Advisory
• https://helpx.adobe.com/security/products/acrobat/apsb22-01.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02709 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44740 · Note