CVE-2017-16392

published 2017-12-09

CVE-2017-16392: An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier…

Priority P3 55 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer access with an incorrect length value in the JPEG processing module. Crafted input with an unexpected JPEG file segment size causes a mismatch between allocated buffer size and the access allowed by the computation. If an attacker can adequately control the accessible memory then this vulnerability can be leveraged to achieve arbitrary code execution.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
adobe	acrobat	<= 11.0.22	—
adobe	acrobat	17.0 – 17.011.30066	—
adobe	acrobat_dc	- – 17.012.20098	—
adobe	acrobat_dc	15.0 – 15.006.30355	—
adobe	acrobat_reader	<= 11.0.22	—
adobe	acrobat_reader	17.0 – 17.011.30066	—
adobe	acrobat_reader_dc	- – 17.012.20098	—
adobe	acrobat_reader_dc	15.0 – 15.006.30355	—

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119