CVE-2018-4916

EUVD-2018-16701

27.02.2018, 05:29

An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the image conversion module that handless TIFF data. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.8 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 88%

Affected Products (NVD)

Vendor	Product	Version
adobe	acrobat	17.0 ≤ 𝑥 ≤ 17.011.30070
adobe	acrobat_dc	𝑥 ≤ 18.009.20050
adobe	acrobat_dc	15.0 ≤ 𝑥 ≤ 15.006.30394
adobe	acrobat_reader	17.0 ≤ 𝑥 ≤ 17.011.30070
adobe	acrobat_reader_dc	𝑥 ≤ 18.009.20050
adobe	acrobat_reader_dc	15.0 ≤ 𝑥 ≤ 15.006.30394

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

http://www.securityfocus.com/bid/102994

http://www.securitytracker.com/id/1040364

https://helpx.adobe.com/security/products/acrobat/apsb18-02.html

https://www.zerodayinitiative.com/advisories/ZDI-18-209/

http://www.securityfocus.com/bid/102994

http://www.securitytracker.com/id/1040364

https://helpx.adobe.com/security/products/acrobat/apsb18-02.html