PT-2024-5922 · Adobe · Acrobat Reader

Published 2024-08-13 · Updated 2024-09-10 · CVE-2024-45107

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Adobe Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier

Description The issue is related to a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction, in that a victim must open a malicious file.

Recommendations For Adobe Acrobat Reader versions 20.005.30636, 24.002.20964, 24.001.30123, 24.002.20991 and earlier, upgrade to the latest version to mitigate the risk. As a temporary workaround, consider avoiding the use of the vulnerable Doc Object until a patch is available. Restrict access to malicious files to minimize the risk of exploitation.

Fix

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

BDU:2024-06728

CVE-2024-45107

ZDI-24-1196

Affected Products

Acrobat Reader

References · 12

• https://helpx.adobe.com/security/products/acrobat/apsb24-57.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06728 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-1196 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45107 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45107 · Security Note
• https://twitter.com/SystemTek_UK/status/1833472178186067982 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45107 · Note
• https://twitter.com/oktsec/status/1831652023353168070 · Twitter Post
• https://twitter.com/CVEnew/status/1831622253278105728 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1831642202755199191 · Twitter Post
• https://t.me/cvenotify/93282 · Telegram Post
• https://t.me/cvedetector/4892 · Telegram Post