Rewterz Threat Advisory – Multiple Adobe Security Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2021-39829

Adobe Framemaker could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write error. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash.

CVE-2021-39823

Adobe SVG-Native-Viewer Library is vulnerable to a heap-based buffer overflow. By persuading a victim to open a specially-crafted document, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVE-2021-39851

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-39849

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-39850

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service

CVE-2021-39853

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-39854

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-39852

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-39859

Adobe Acrobat and Adobe Reader could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free error. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash

CVE-2021-35982

Adobe Acrobat and Adobe Reader could allow a remote attacker to gain elevated prvileges on the system, caused by an uncontrolled search path element flaw. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim.

CVE-2021-39858

Adobe Acrobat and Adobe Reader could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to read arbitrary files on the system.

CVE-2021-39861

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by an out-of-bounds read. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2021-39855

Adobe Acrobat and Adobe Reader could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to read arbitrary files on the system.

CVE-2021-39856

Adobe Acrobat and Adobe Reader could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to read arbitrary files on the system.

CVE-2021-39863

Adobe Acrobat and Adobe Reader are vulnerable to a heap-based buffer overflow. By persuading a victim to open a specially-crafted document, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.

CVE-2021-39857

Adobe Acrobat and Adobe Reader could allow a remote attacker to obtain sensitive information. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to read arbitrary files on the system.

CVE-2021-39860

Adobe Acrobat and Adobe Reader are vulnerable to a denial of service, caused by a NULL pointer dereference. By persuading a victim to open a specially-crafted document, a remote attacker could exploit this vulnerability to cause a denial of service.

Impact

• Denial of Service
• Code Execution
• Information Theft
• Unauthorized Access

Affected Vendors

Adobe

Affected Products

• Adobe Framemaker 2019 Update 8
• Adobe Framemaker 2020 Update 2
• Adobe SVG-Native-Viewer
• Adobe Acrobat Reader 2017 2017.011.30199
• Adobe Acrobat 2017 2017.011.30199
• Adobe Acrobat 2020 2020.004.30006

Remediation

Refer to Adobe Security Bulletin APSB21-55 for patch, upgrade or suggested workaround information.

https://helpx.adobe.com/security/products/acrobat/apsb21-55.html