Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability in the image conversion engine, related to parsing of EMF - enhanced meta file format.

The version of Adobe Reader installed on the remote macOS or Mac OS X host is a version prior to 11.0.20, 2015.006.30306, 2017.009.20044. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exists that allow an     attacker to execute arbitrary code. (CVE-2017-3014,     CVE-2017-3026, CVE-2017-3027, CVE-2017-3035,     CVE-2017-3047, CVE-2017-3057)

  - Multiple heap buffer overflow conditions exist that     allow an attacker to execute arbitrary code.
    (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049,     CVE-2017-3055)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2017-3015,     CVE-2017-3017, CVE-2017-3018, CVE-2017-3019,     CVE-2017-3023, CVE-2017-3024, CVE-2017-3025,     CVE-2017-3028, CVE-2017-3030, CVE-2017-3036,     CVE-2017-3037, CVE-2017-3038, CVE-2017-3039,     CVE-2017-3040, CVE-2017-3041, CVE-2017-3044,     CVE-2017-3050, CVE-2017-3051, CVE-2017-3054,     CVE-2017-3056, CVE-2017-3065)

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2017-3011,     CVE-2017-3034)

  - Multiple memory corruption issues exist that allow an     an attacker to disclose memory address information.
    (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022,     CVE-2017-3029, CVE-2017-3031, CVE-2017-3032,     CVE-2017-3033, CVE-2017-3043, CVE-2017-3045,     CVE-2017-3046, CVE-2017-3052, CVE-2017-3053)

  - A flaw exists due the use of an insecure directory     search path. An attacker can potentially exploit this to     execute arbitrary code. (CVE-2017-3012, CVE-2017-3013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote macOS or Mac OS X host is a version prior to 11.0.20, 2015.006.30306, 2017.009.20044. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exists that allow an     attacker to execute arbitrary code. (CVE-2017-3014,     CVE-2017-3026, CVE-2017-3027, CVE-2017-3035,     CVE-2017-3047, CVE-2017-3057)

  - Multiple heap buffer overflow conditions exist that     allow an attacker to execute arbitrary code.
    (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049,     CVE-2017-3055)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2017-3015,     CVE-2017-3017, CVE-2017-3018, CVE-2017-3019,     CVE-2017-3023, CVE-2017-3024, CVE-2017-3025,     CVE-2017-3028, CVE-2017-3030, CVE-2017-3036,     CVE-2017-3037, CVE-2017-3038, CVE-2017-3039,     CVE-2017-3040, CVE-2017-3041, CVE-2017-3044,     CVE-2017-3050, CVE-2017-3051, CVE-2017-3054,     CVE-2017-3056, CVE-2017-3065)

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2017-3011,     CVE-2017-3034)

  - Multiple memory corruption issues exist that allow an     an attacker to disclose memory address information.
    (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022,     CVE-2017-3029, CVE-2017-3031, CVE-2017-3032,     CVE-2017-3033, CVE-2017-3043, CVE-2017-3045,     CVE-2017-3046, CVE-2017-3052, CVE-2017-3053)

  - A flaw exists due the use of an insecure directory     search path. An attacker can potentially exploit this to     execute arbitrary code. (CVE-2017-3012, CVE-2017-3013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2017-3014,     CVE-2017-3026, CVE-2017-3027, CVE-2017-3035,     CVE-2017-3047, CVE-2017-3057)

  - Multiple heap buffer overflow conditions exist that     allow an attacker to execute arbitrary code.
    (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049,     CVE-2017-3055)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2017-3015,     CVE-2017-3017, CVE-2017-3018, CVE-2017-3019,     CVE-2017-3023, CVE-2017-3024, CVE-2017-3025,     CVE-2017-3028, CVE-2017-3030, CVE-2017-3036,     CVE-2017-3037, CVE-2017-3038, CVE-2017-3039,     CVE-2017-3040, CVE-2017-3041, CVE-2017-3044,     CVE-2017-3050, CVE-2017-3051, CVE-2017-3054,     CVE-2017-3056, CVE-2017-3065)

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2017-3011,     CVE-2017-3034)

  - Multiple memory corruption issues exist that allow an     an attacker to disclose memory address information.
    (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022,     CVE-2017-3029, CVE-2017-3031, CVE-2017-3032,     CVE-2017-3033, CVE-2017-3043, CVE-2017-3045,     CVE-2017-3046, CVE-2017-3052, CVE-2017-3053)

  - A flaw exists due to the use of an insecure directory     search path. An attacker can potentially exploit this to     execute arbitrary code. (CVE-2017-3012, CVE-2017-3013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 11.0.20, 2015.006.30306, or 2017.009.20044. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exists that allow an     attacker to execute arbitrary code. (CVE-2017-3014,     CVE-2017-3026, CVE-2017-3027, CVE-2017-3035,     CVE-2017-3047, CVE-2017-3057)

  - Multiple heap buffer overflow conditions exist that     allow an attacker to execute arbitrary code.
    (CVE-2017-3042, CVE-2017-3048, CVE-2017-3049,     CVE-2017-3055)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2017-3015,     CVE-2017-3017, CVE-2017-3018, CVE-2017-3019,     CVE-2017-3023, CVE-2017-3024, CVE-2017-3025,     CVE-2017-3028, CVE-2017-3030, CVE-2017-3036,     CVE-2017-3037, CVE-2017-3038, CVE-2017-3039,     CVE-2017-3040, CVE-2017-3041, CVE-2017-3044,     CVE-2017-3050, CVE-2017-3051, CVE-2017-3054,     CVE-2017-3056, CVE-2017-3065)

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2017-3011,     CVE-2017-3034)

  - Multiple memory corruption issues exist that allow an     an attacker to disclose memory address information.
    (CVE-2017-3020, CVE-2017-3021, CVE-2017-3022,     CVE-2017-3029, CVE-2017-3031, CVE-2017-3032,     CVE-2017-3033, CVE-2017-3043, CVE-2017-3045,     CVE-2017-3046, CVE-2017-3052, CVE-2017-3053)

  - A flaw exists due the use of an insecure directory     search path. An attacker can potentially exploit this to     execute arbitrary code. (CVE-2017-3012, CVE-2017-3013)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
99376	Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11) (macOS)	Nessus	MacOS X Local Security Checks	critical
99375	Adobe Acrobat < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11) (macOS)	Nessus	MacOS X Local Security Checks	critical
99374	Adobe Reader < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)	Nessus	Windows	critical
99373	Adobe Acrobat < 11.0.20 / 2015.006.30306 / 2017.009.20044 Multiple Vulnerabilities (APSB17-11)	Nessus	Windows	critical

Detections

Analytics

CVE-2017-3052

medium

Tenable Plugins

critical

critical

critical

critical