CVE-2017-3057

HIGH

Adobe Acrobat Reader < 11.0.19, < 15.006.30280, < 15.023.20070 Use-After-Free in JavaScript API

Title source: llm

Description

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an exploitable use after free vulnerability in the JavaScript API related to the collaboration functionality. Successful exploitation could lead to arbitrary code execution.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry

http://www.zerodayinitiative.com/advisories/ZDI-17-282/

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1038228

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/97550

Vendor Advisory x_refsource_confirm

https://helpx.adobe.com/security/products/acrobat/apsb17-11.html

Scores

CVSS v3 7.8

EPSS 0.0519

EPSS Percentile 91.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-416

Status published

Products (7)

adobe/acrobat < 11.0.19

adobe/acrobat_dc < 15.006.30280

adobe/acrobat_dc < 15.023.20070

adobe/acrobat_reader_dc < 15.006.30280

adobe/acrobat_reader_dc < 15.023.20070

adobe/reader < 11.0.19

n/a/Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier. Adobe Acrobat Reader 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier.

Published Apr 12, 2017

Tracked Since Feb 18, 2026