CVE-2017-3092

CWE-427CWE-20 — Improper Input ValidationCWE-400 — Uncontrolled Resource Consumption7 documents6 sources
Severity
9.8CRITICAL
EPSS
6.9%
top 8.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Adobe Digital Editions
Timeline
PublishedJun 20
Latest updateMay 14

Description

Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of editor control library functions in the installer plugin. A successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5adobe_digital_editions_4.5.4_and_earlier.Adobe Digital Editions 4.5.4 and earlier.

🔴Vulnerability Details

3
GHSA
Improper Input Validation in Jenkins↗2022-05-14
▶
GHSA
GHSA-63h6-phpf-qj3f: Adobe Digital Editions versions 4↗2022-05-13
▶
CVEList
CVE-2017-3092: Adobe Digital Editions versions 4↗2017-06-20
▶

📋Vendor Advisories

1
Red Hat
jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)↗2017-10-11
▶

💬Community

2
Bugzilla
CVE-2017-1000394 jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)↗2017-10-13
▶
Bugzilla
CVE-2017-11572 fontforge: Heap-based buffer over-read in readcfftopidcts function↗2017-07-26
▶
CVE-2017-3092 (CRITICAL CVSS 9.8) | Adobe Digital Editions versions 4.5 | cvebase.io