Adobe Acrobat and Reader APSB17-24 Multiple Heap Buffer Overflow Vulnerabilities

Bugtraq ID:	100180
Class:	Boundary Condition Error
CVE:	CVE-2017-11241 CVE-2017-11211 CVE-2017-3117 CVE-2017-3121 CVE-2017-11220
Remote:	Yes
Local:	No
Published:	Aug 08 2017 12:00AM
Updated:	Aug 08 2017 12:00AM
Credit:	Cybellum Technologies LTD, Steven Seeley working with Beyond Security�??s SecuriTeam Secure Disclosure Program, and Ke Liu of Tencent's Xuanwu LAB and @vftable working with Trend Micro's Zero Day Initiative
Vulnerable:	Adobe Reader 11.0.20 Adobe Reader 11.0.19 Adobe Reader 11.0.18 Adobe Reader 11.0.17 Adobe Reader 11.0.16 Adobe Reader 11.0.12 Adobe Reader 11.0.11 Adobe Reader 11.0.7 Adobe Reader 11.0.6 Adobe Reader 11.0.4 Adobe Reader 11.0.3 Adobe Reader 11.0.1 Adobe Reader 11.0.15 Adobe Reader 11.0.14 Adobe Reader 11.0.13 Adobe Reader 11.0.10 Adobe Reader 11.0.09 Adobe Reader 11.0.08 Adobe Reader 11.0.05 Adobe Reader 11.0 Adobe Acrobat Reader DC 2017.9.20058 Adobe Acrobat Reader DC 2017.9.20044 Adobe Acrobat Reader DC 2015.6.30306 Adobe Acrobat Reader DC 15.23.20070 Adobe Acrobat Reader DC 15.23.20053 Adobe Acrobat Reader DC 15.20.20042 Adobe Acrobat Reader DC 15.20.20039 Adobe Acrobat Reader DC 15.17.20053 Adobe Acrobat Reader DC 15.17.20050 Adobe Acrobat Reader DC 15.16.20045 Adobe Acrobat Reader DC 15.16.20039 Adobe Acrobat Reader DC 15.10.20060 Adobe Acrobat Reader DC 15.10.20059 Adobe Acrobat Reader DC 15.9.20077 Adobe Acrobat Reader DC 15.6.30280 Adobe Acrobat Reader DC 15.6.30279 Adobe Acrobat Reader DC 15.6.30244 Adobe Acrobat Reader DC 15.6.30243 Adobe Acrobat Reader DC 15.6.30201 Adobe Acrobat Reader DC 15.6.30198 Adobe Acrobat Reader DC 15.6.30174 Adobe Acrobat Reader DC 15.6.30172 Adobe Acrobat Reader DC 15.6.30121 Adobe Acrobat Reader DC 15.6.30097 Adobe Acrobat Reader DC 15.010.20056 Adobe Acrobat Reader DC 15.006.30119 Adobe Acrobat Reader 2017.8.30051 Adobe Acrobat DC 2017.9.20058 Adobe Acrobat DC 2017.9.20044 Adobe Acrobat DC 2015.6.30306 Adobe Acrobat DC 15.23.20070 Adobe Acrobat DC 15.23.20053 Adobe Acrobat DC 15.20.20042 Adobe Acrobat DC 15.20.20039 Adobe Acrobat DC 15.17.20053 Adobe Acrobat DC 15.17.20050 Adobe Acrobat DC 15.16.20045 Adobe Acrobat DC 15.16.20039 Adobe Acrobat DC 15.10.20060 Adobe Acrobat DC 15.10.20059 Adobe Acrobat DC 15.9.20077 Adobe Acrobat DC 15.6.30280 Adobe Acrobat DC 15.6.30279 Adobe Acrobat DC 15.6.30244 Adobe Acrobat DC 15.6.30243 Adobe Acrobat DC 15.6.30201 Adobe Acrobat DC 15.6.30198 Adobe Acrobat DC 15.6.30174 Adobe Acrobat DC 15.6.30172 Adobe Acrobat DC 15.6.30121 Adobe Acrobat DC 15.6.30097 Adobe Acrobat DC 15.010.20056 Adobe Acrobat DC 15.006.30119 Adobe Acrobat 2017.8.30051 Adobe Acrobat 11.0.20 Adobe Acrobat 11.0.19 Adobe Acrobat 11.0.18 Adobe Acrobat 11.0.17 Adobe Acrobat 11.0.16 Adobe Acrobat 11.0.11 Adobe Acrobat 11.0.7 Adobe Acrobat 11.0.6 Adobe Acrobat 11.0.6 Adobe Acrobat 11.0.4 Adobe Acrobat 11.0.2 Adobe Acrobat 11.0 Adobe Acrobat 11.0.9 Adobe Acrobat 11.0.7 Adobe Acrobat 11.0.3 Adobe Acrobat 11.0.15 Adobe Acrobat 11.0.14 Adobe Acrobat 11.0.13 Adobe Acrobat 11.0.12 Adobe Acrobat 11.0.10 Adobe Acrobat 11.0.1 Adobe Acrobat 11.0.09 Adobe Acrobat 11.0.08 Adobe Acrobat 11.0
Not Vulnerable:	Adobe Reader 11.0.21 Adobe Acrobat Reader DC 2017.12.20093 Adobe Acrobat Reader DC 2015.6.30352 Adobe Acrobat Reader 2017.11.30059 Adobe Acrobat DC 2017.12.20093 Adobe Acrobat DC 2015.6.30352 Adobe Acrobat 2017.11.30059 Adobe Acrobat 11.0.21

Adobe Acrobat and Reader APSB17-24 Multiple Heap Buffer Overflow Vulnerabilities

Adobe Acrobat and Reader are prone to multiple heap-based buffer-overflow vulnerabilities.

Attackers can exploit these issues to execute arbitrary code within the context of the application. Failed attempts will likely cause a denial-of-service condition.

Adobe Acrobat and Reader APSB17-24 Multiple Heap Buffer Overflow Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Acrobat and Reader APSB17-24 Multiple Heap Buffer Overflow Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Adobe Acrobat and Reader APSB17-24 Multiple Heap Buffer Overflow Vulnerabilities

References:

• Acrobat Homepage (Adobe)
  
• Adobe Homepage (Adobe)
  
• Adobe Reader Homepage (Adobe)
  
• APSB17-24: Security Update Available for Adobe Acrobat and Reader | APSB17-24 (Adobe)