CVE-2017-16374

HIGH

Adobe Acrobat and Reader <2017.012.20098 - Buffer Overflow

Title source: llm

Description

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the JPEG 2000 module. An invalid JPEG 2000 input code stream leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information, such as object heap addresses, etc.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1039791

Vendor Advisory x_refsource_confirm

https://helpx.adobe.com/security/products/acrobat/apsb17-36.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/101824

Scores

CVSS v3 8.8

EPSS 0.1792

EPSS Percentile 95.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-125

Status published

Products (7)

adobe/acrobat < 11.0.22

adobe/acrobat_dc - - 17.012.20098

adobe/acrobat_dc 15.0 - 15.006.30355

adobe/acrobat_reader < 11.0.22

adobe/acrobat_reader_dc - - 17.012.20098

adobe/acrobat_reader_dc 15.0 - 15.006.30355

n/a/Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, 11.0.22 and earlier versions Adobe Acrobat Reader 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.

Published Dec 09, 2017

Tracked Since Feb 18, 2026