Adobe Digital Editions CVE-2017-11272 XML Entity Parsing Information Disclosure Vulnerability

Bugtraq ID:	100193
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-11272
Remote:	Yes
Local:	No
Published:	Aug 08 2017 12:00AM
Updated:	Aug 23 2017 12:11PM
Credit:	Steven Seeley of Source Incite
Vulnerable:	Adobe Digital Editions 4.5.4 Adobe Digital Editions 4.5.3 Adobe Digital Editions 4.5.2 Adobe Digital Editions 4.5.1 Adobe Digital Editions 4.5 Adobe Digital Editions 4.0.3 Adobe Digital Editions 4.0.2 Adobe Digital Editions 4.0.1 Adobe Digital Editions 4.0 Adobe Digital Editions 3.0 Adobe Digital Editions 2.0.67532 Adobe Digital Editions 2.0.1 Adobe Digital Editions 2.0.0
Not Vulnerable:	Adobe Digital Editions 4.5.6

Adobe Digital Editions CVE-2017-11272 XML Entity Parsing Information Disclosure Vulnerability

Adobe Digital Editions is prone to an information-disclosure vulnerability due to an error when parsing XML external entities.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

Adobe Digital Editions 4.5.4 and prior are vulnerable.

Adobe Digital Editions CVE-2017-11272 XML Entity Parsing Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Adobe Digital Editions CVE-2017-11272 XML Entity Parsing Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Adobe Digital Editions CVE-2017-11272 XML Entity Parsing Information Disclosure Vulnerability

References:

• Adobe Digital Editions / Release Notes (Adobe)
  
• Adobe Homepage (Adobe)
  
• Security updates available for Adobe Digital Editions | APSB17-27 (Adobe)