CVE-2017-16362 — HIGH (8.8)

Q: How severe is CVE-2017-16362?

CVE-2017-16362 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2017-16362?

Check the references section above for vendor advisories and patch information. Affected products include: Adobe Acrobat, Adobe Acrobat Dc, Adobe Acrobat Reader, Adobe Acrobat Reader Dc.

Vulnerability Description

An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of an out of bounds read vulnerability in the MakeAccesible plugin, when handling font data. It causes an out of bounds memory access, which sometimes triggers an access violation exception. Attackers can exploit the vulnerability by using the out of bounds access for unintended reads, writes, or frees, potentially leading to code corruption, control-flow hijack, or an information leak attack.

CVSS Score

8.8

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Adobe	Acrobat	<= 11.0.22
Adobe	Acrobat Dc	>= -, <= 17.012.20098
Adobe	Acrobat Reader	<= 11.0.22
Adobe	Acrobat Reader Dc	>= -, <= 17.012.20098

Related Weaknesses (CWE)

CWE-125

References

http://www.securityfocus.com/bid/102140Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039791Third Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb17-36.htmlVendor Advisory
http://www.securityfocus.com/bid/102140Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039791Third Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb17-36.htmlVendor Advisory

FAQ

What is CVE-2017-16362?

CVE-2017-16362 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versions, and 11.0.22 and earlier versions. Th...

How severe is CVE-2017-16362?

CVE-2017-16362 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-16362?

Check the references section above for vendor advisories and patch information. Affected products include: Adobe Acrobat, Adobe Acrobat Dc, Adobe Acrobat Reader, Adobe Acrobat Reader Dc.