CVE-2019-8023: Critical severity Adobe Acrobat DC vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability can be exploited remotely without authentication or user interaction. Its CVSS vector indicates low attack complexity and no required privileges.

Q: What impact could successful exploitation have?

Successful exploitation could result in arbitrary code execution. The CVSS metrics indicate high potential impact to confidentiality, integrity, and availability.

Q: Which deployed versions are affected?

Affected releases include Acrobat and Reader 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier.

Published Aug 20, 2019

Updated

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Affected Software

8 affected components

Adobe Acrobat DC>=15.006.30060<15.006.30499

Adobe Acrobat DC>=15.008.20082<19.012.20036

Adobe Acrobat DC>=17.011.30059<17.011.30144

Adobe Acrobat Reader DC>=15.006.30060<15.006.30499

Adobe Acrobat Reader DC>=15.008.20082<19.012.20036

Adobe Acrobat Reader DC>=17.011.30059<17.011.30144

Apple macOS

Microsoft Windows

Remediation

Patch Available

https://helpx.adobe.com/security/products/acrobat/apsb19-41.html

Event History

Aug 20, 2019

CVE Published

via MITRE·07:44 PM

Data Sourced

via MITRE·07:44 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability can be exploited remotely without authentication or user interaction. Its CVSS vector indicates low attack complexity and no required privileges.

What impact could successful exploitation have?

Successful exploitation could result in arbitrary code execution. The CVSS metrics indicate high potential impact to confidentiality, integrity, and availability.

Which deployed versions are affected?

Affected releases include Acrobat and Reader 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier.

Is a fix available?

Yes. A patch is available.