Patch Tuesday:  26 critical vulnerabilities patched in Adobe Acrobat and Reader

Cybersecurity specialists report the detection of 26 vulnerabilities in Adobe Acrobat and Adobe Reader, two popular software tools. According to the report, the successful exploitation of these flaws would allow the deployment of all kinds of attack variants.

Below are brief descriptions of some of the reported flaws, in addition to their respective tracking keys and scores assigned according to the Common Vulnerability Scoring System (CVSS).

CVE-2021-39841: A type confusion error when processing PDF files allows remote threat actors to trick victims into opening a specially crafted PDF file, trigger a type confusion error and run arbitrary code on the affected system.   

The flaw got a 7.7/10 CVSS score and its successful exploitation would allow to fully compromise the affected implementation.

CVE-2021-39842: A use-after-free error when processing PDF files would allow remote hackers to trick the victim into opening a specially crafted PDF file for malicious purposes.

The vulnerability received a CVSS score of 7.7/10 and its exploitation would allow arbitrary code execution on the target system.

Patch Tuesday:  26 critical vulnerabilities patched in Adobe Acrobat and Reader

CVE-2021-39851: CVE-2021-39850: A NULL pointer dereference flaw would allow remote hackers to trick a target user in order to trigger a denial of service (DoS) attack.

This is a low severity flaw and received a CVSS score of 3.8/10.

CVE-2021-39849: A NULL pointer dereference flaw would allow remote threat actors to trigger a DoS condition using only a specially crafted file.

The vulnerability received a CVSS score of 3.8/10.

CVE-2021-39850: A NULL pointer dereference flaw would allow remote hackers to trick a target user in order to trigger a DoS condition.

The flaw received a CVSS score of 3.8/10.

CVE-2021-39853: A NULL pointer dereference flaw in affected applications allows remote hackers to trick the victim with a specially crafted file, generating a DoS condition.

This vulnerability received a CVSS score of 3.8/10.

CVE-2021-39854: A NULL pointer dereference flaw would allow remote threat actors to trigger a DoS condition using only a specially crafted file.

The flaw received a CVSS score of 3.8/10.

CVE-2021-39852: A NULL pointer dereference flaw in the affected applications would allow remote threat actors to trick the victim and trigger a DoS condition.

This is a low-severity flaw and received a 3.8/10 CVSS score.

CVE-2021-39836: A use-after-free error when processing PDF files would allow remote attackers to execute arbitrary code on the affected system using a specially crafted PDF document.

This is a high-severity vulnerability and received a CVSS score of 7.7/10.

All the reported flaws reside in the following products and software versions:

Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2017.011.30196, 2017.011.30197 and 2017.011.30199.

Adobe Acrobat Reader DC: 2020.001.30020, 2020.001.30025, 2020.004.30005, 2020.004.30006, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150, 2021.001.20155, 2021.005.20054, 2021.005.20058, 2021.005.20060 and 2021.005.20148.

Adobe Reader: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175 and 2017.011.30199.

These flaws can be exploited remotely by non authenticated threat actors; nonetheless, cybersecurity specialists have no detected exploitation attempts in the wild. Updates are now ready, so users of affected deployments are encouraged to correct as soon as possible. The full list of vulnerabilities addressed is available on Adobe’s official platforms.

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.

The post Patch Tuesday: 26 critical vulnerabilities patched in Adobe Acrobat and Reader appeared first on Cyber Security News | Exploit One | Hacking News.

Go to Source of this post
Author Of this post: Daniel Tai

By admin