KLA51723 Multiple vulnerabilities in Adobe Acrobat and Adobe Acrobat Reader

Multiple vulnerabilities were found in Adobe Acrobat and Adobe Acrobat Reader. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, execute arbitrary code, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. Out of bounds read vulnerability can be exploited to obtain sensitive information.
2. Input validation vulnerability can be exploited to cause denial of service.
3. Uninitialized pointer vulnerability can be exploited to execute arbitrary code.
4. Use after free vulnerability can be exploited execute arbitrary code.
5. Input validation vulnerability can be exploited to execute arbitrary code.
6. Out of bounds write vulnerability can be exploited to execute arbitrary code.
7. Use after free vulnerability can be exploited obtain sensitive information.
8. Improper Access Control vulnerability can be exploited to bypass security restrictions.

Original advisories

APSB23-30

Related products

Adobe-Acrobat-Reader-DC-Continuous

Adobe-Acrobat-DC-Continuous

Adobe-Acrobat-Reader-2020

Adobe-Acrobat-2020

CVE list

CVE-2023-38244 high

CVE-2023-29299 warning

CVE-2023-38246 critical

CVE-2023-38225 critical

CVE-2023-38242 high

CVE-2023-38245 high

CVE-2023-38231 critical

CVE-2023-29303 high

CVE-2023-38224 critical

CVE-2023-38233 critical

CVE-2023-38230 high

CVE-2023-38232 high

CVE-2023-38229 critical

CVE-2023-38236 high

CVE-2023-38238 high

CVE-2023-38247 high

CVE-2023-38234 critical

CVE-2023-38239 high

CVE-2023-29320 critical

CVE-2023-38235 high

CVE-2023-38241 high

CVE-2023-38223 critical

CVE-2023-38226 critical

CVE-2023-38243 high

CVE-2023-38228 critical

CVE-2023-38222 critical

CVE-2023-38237 high

CVE-2023-38248 high

CVE-2023-38240 high

CVE-2023-38227 critical

Solution

Update to the latest version

Download Adobe Acrobat Reader DC

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Adobe Acrobat DC Continuous earlier than 23.003.20269Adobe Acrobat Reader DC Continuous earlier than 23.003.20269Adobe Acrobat 2020 Classic earlier than 20.005.30514.10514Adobe Acrobat Reader 2020 Classic earlier than 20.005.30514.10514