Cybersecurity specialists report the detection of 26 vulnerabilities in Adobe Acrobat and Adobe Reader, two popular software tools. According to the report, the successful exploitation of these flaws would allow the deployment of all kinds of attack variants.
Below are brief descriptions of some of the reported flaws, in addition to their respective tracking keys and scores assigned according to the Common Vulnerability Scoring System (CVSS).
CVE-2021-39841: A type confusion error when processing PDF files allows remote threat actors to trick victims into opening a specially crafted PDF file, trigger a type confusion error and run arbitrary code on the affected system.
The flaw got a 7.7/10 CVSS score and its successful exploitation would allow to fully compromise the affected implementation.
CVE-2021-39842: A use-after-free error when processing PDF files would allow remote hackers to trick the victim into opening a specially crafted PDF file for malicious purposes.
The vulnerability received a CVSS score of 7.7/10 and its exploitation would allow arbitrary code execution on the target system.
CVE-2021-39851: CVE-2021-39850: A NULL pointer dereference flaw would allow remote hackers to trick a target user in order to trigger a denial of service (DoS) attack.
This is a low severity flaw and received a CVSS score of 3.8/10.
CVE-2021-39849: A NULL pointer dereference flaw would allow remote threat actors to trigger a DoS condition using only a specially crafted file.
The vulnerability received a CVSS score of 3.8/10.
CVE-2021-39850: A NULL pointer dereference flaw would allow remote hackers to trick a target user in order to trigger a DoS condition.
The flaw received a CVSS score of 3.8/10.
CVE-2021-39853: A NULL pointer dereference flaw in affected applications allows remote hackers to trick the victim with a specially crafted file, generating a DoS condition.
This vulnerability received a CVSS score of 3.8/10.
CVE-2021-39854: A NULL pointer dereference flaw would allow remote threat actors to trigger a DoS condition using only a specially crafted file.
The flaw received a CVSS score of 3.8/10.
CVE-2021-39852: A NULL pointer dereference flaw in the affected applications would allow remote threat actors to trick the victim and trigger a DoS condition.
This is a low-severity flaw and received a 3.8/10 CVSS score.
CVE-2021-39836: A use-after-free error when processing PDF files would allow remote attackers to execute arbitrary code on the affected system using a specially crafted PDF document.
This is a high-severity vulnerability and received a CVSS score of 7.7/10.
All the reported flaws reside in the following products and software versions:
Adobe Acrobat: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30096, 2017.011.30102, 2017.011.30105, 2017.011.30120, 2017.011.30127, 2017.011.30148, 2017.011.30150, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175, 2017.011.30180, 2017.011.30188, 2017.011.30190, 2017.011.30194, 2017.011.30196, 2017.011.30197 and 2017.011.30199.
Adobe Acrobat Reader DC: 2020.001.30020, 2020.001.30025, 2020.004.30005, 2020.004.30006, 2020.006.20034, 2020.006.20042, 2020.009.20063, 2020.009.20074, 2020.012.20041, 2020.012.20048, 2020.013.20064, 2020.013.20066, 2020.013.20074, 2021.001.20135, 2021.001.20149, 2021.001.20150, 2021.001.20155, 2021.005.20054, 2021.005.20058, 2021.005.20060 and 2021.005.20148.
Adobe Reader: 2017.008.30051, 2017.011.30066, 2017.011.30068, 2017.011.30070, 2017.011.30078, 2017.011.30099, 2017.011.30102, 2017.011.30105, 2017.011.30152, 2017.011.30156, 2017.011.30158, 2017.011.30166, 2017.011.30171, 2017.011.30175 and 2017.011.30199.
These flaws can be exploited remotely by non authenticated threat actors; nonetheless, cybersecurity specialists have no detected exploitation attempts in the wild. Updates are now ready, so users of affected deployments are encouraged to correct as soon as possible. The full list of vulnerabilities addressed is available on Adobe’s official platforms.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.