CVE-2017-16375: Buffer Overflow
First published: Sat Dec 09 2017(Updated: )
An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This issue is due to an untrusted pointer dereference in the JavaSscript API engine. In this scenario, the JavaScript input is crafted in way that the computation results in pointers to memory locations that do not belong to the relevant process address space. The dereferencing operation is a read operation, and an attack can result in sensitive data exposure.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | <=11.0.22 | |
| Adobe Acrobat Reader | >=17.0<=17.011.30066 | |
| Adobe Acrobat | >=-<=17.012.20098 | |
| Adobe Acrobat | >=15.0<=15.006.30355 | |
| Adobe Acrobat Reader | <=11.0.22 | |
| Adobe Acrobat Reader | >=17.0<=17.011.30066 | |
| Adobe Acrobat Reader | >=-<=17.012.20098 | |
| Adobe Acrobat Reader | >=15.0<=15.006.30355 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-16375?
CVE-2017-16375 is classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2017-16375?
To fix CVE-2017-16375, update Adobe Acrobat and Reader to the latest version as provided by Adobe.
What versions of Adobe products are affected by CVE-2017-16375?
CVE-2017-16375 affects Adobe Acrobat and Reader versions prior to 2017.012.20098, among other specific earlier versions.
What kind of vulnerability is CVE-2017-16375?
CVE-2017-16375 is an untrusted pointer dereference vulnerability in the JavaScript API engine.
What are the potential consequences of exploiting CVE-2017-16375?
Exploitation of CVE-2017-16375 could allow an attacker to execute arbitrary code on the affected system.
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/11.0.22
- version/adobe acrobat reader/17.0
- version/adobe acrobat reader/17.011.30066
- canonical/adobe acrobat
- version/adobe acrobat/-
- version/adobe acrobat/17.012.20098
- version/adobe acrobat/15.0
- version/adobe acrobat/15.006.30355
- version/adobe acrobat reader/-
- version/adobe acrobat reader/17.012.20098
- version/adobe acrobat reader/15.0
- version/adobe acrobat reader/15.006.30355