Detections
Analytics

Adobe Reader <= 2015.006.30497 / 2017.011.30142 / 2019.012.20034 Multiple Vulnerabilities (APSB19-41) (macOS)

critical Nessus Plugin ID 127902

Language:

Synopsis

The version of Adobe Reader installed on the remote macOS host is affected by multiple vulnerabilities.

Description

The version of Adobe Reader installed on the remote macOS host is a version prior or equal to 2015.006.30497, 2017.011.30142, or 2019.012.20034. It is, therefore, affected by multiple vulnerabilities.

 - Out-of-Bounds Read potentially leading to Information Disclosure (CVE-2019-8077, CVE-2019-8094, CVE-2019-8095, CVE-2019-8096, CVE-2019-8102, CVE-2019-8103, CVE-2019-8104, CVE-2019-8105, CVE-2019-8106, CVE-2019-8002, CVE-2019-8004, CVE-2019-8005, CVE-2019-8007, CVE-2019-8010, CVE-2019-8011, CVE-2019-8012, CVE-2019-8018, CVE-2019-8020, CVE-2019-8021, CVE-2019-8032, CVE-2019-8035, CVE-2019-8037, CVE-2019-8040, CVE-2019-8043, CVE-2019-8052)

 - Out-of-Bounds Write potentially leading to Arbitrary Code Execution (CVE-2019-8098, CVE-2019-8100, CVE-2019-7965, CVE-2019-8008, CVE-2019-8009, CVE-2019-8016, CVE-2019-8022, CVE-2019-8023, CVE-2019-8027)

 - Type Confusion potentially leading to Arbitrary Code Execution (CVE-2019-8019)

 - Use After Free potentially leading to Arbitrary Code Execution (CVE-2019-8003, CVE-2019-8013, CVE-2019-8024, CVE-2019-8025, CVE-2019-8026, CVE-2019-8028, CVE-2019-8029, CVE-2019-8030, CVE-2019-8031, CVE-2019-8033, CVE-2019-8034, CVE-2019-8036, CVE-2019-8038, CVE-2019-8039, CVE-2019-8047, CVE-2019-8051, CVE-2019-8053, CVE-2019-8054, CVE-2019-8055, CVE-2019-8056, CVE-2019-8057, CVE-2019-8058, CVE-2019-8059, CVE-2019-8061)
- Command injection potentially leading to Arbitrary Command Execution (CVE-2019-8060)

 - Heap Overflow potentially leading to Arbitrary Code Execution (CVE-2019-7832, CVE-2019-8014, CVE-2019-8015, CVE-2019-8041, CVE-2019-8042, CVE-2019-8046, CVE-2019-8049, CVE-2019-8050)

 - Buffer Error potentially leading to Arbitrary Code Execution (CVE-2019-8048)

 - Double Free potentially leading to Arbitrary Code Execution (CVE-2019-8044)

 - Integer Overflow potentially leading to Arbitrary Code Execution or Denial of Service (CVE-2019-8099, CVE-2019-8101)

 - Internal IP Disclosure potentially leading to Information Disclosure (CVE-2019-8097)

 - Type Confusion potentially leading to Arbitrary Code Execution (CVE-2019-8019)

 - Untrusted Pointer Dereference potentially leading to Arbitrary Code Execution or Denial of Service (CVE-2019-8006, CVE-2019-8017, CVE-2019-8045)

 - Insufficiently Robust Encryption leading to Security feature bypass. (CVE-2019-8237)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Reader version 2015.006.30499 or 2017.011.30144 or 2019.012.20036 or later.

See Also

https://helpx.adobe.com/security/products/acrobat/apsb19-41.html

Plugin Details

Severity: Critical

ID: 127902

File Name: macos_adobe_reader_apsb19-41.nasl

Version: 1.8

Type: local

Agent: macosx

Published: 8/16/2019

Updated: 8/14/2020

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-7832

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, installed_sw/Adobe Reader

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/13/2019

Vulnerability Publication Date: 8/13/2019

Reference Information

CVE: CVE-2019-7832, CVE-2019-7965, CVE-2019-8002, CVE-2019-8003, CVE-2019-8004, CVE-2019-8005, CVE-2019-8006, CVE-2019-8007, CVE-2019-8008, CVE-2019-8009, CVE-2019-8010, CVE-2019-8011, CVE-2019-8012, CVE-2019-8013, CVE-2019-8014, CVE-2019-8015, CVE-2019-8016, CVE-2019-8017, CVE-2019-8018, CVE-2019-8019, CVE-2019-8020, CVE-2019-8021, CVE-2019-8022, CVE-2019-8023, CVE-2019-8024, CVE-2019-8025, CVE-2019-8026, CVE-2019-8027, CVE-2019-8028, CVE-2019-8029, CVE-2019-8030, CVE-2019-8031, CVE-2019-8032, CVE-2019-8033, CVE-2019-8034, CVE-2019-8035, CVE-2019-8036, CVE-2019-8037, CVE-2019-8038, CVE-2019-8039, CVE-2019-8040, CVE-2019-8041, CVE-2019-8042, CVE-2019-8043, CVE-2019-8044, CVE-2019-8045, CVE-2019-8046, CVE-2019-8047, CVE-2019-8048, CVE-2019-8049, CVE-2019-8050, CVE-2019-8051, CVE-2019-8052, CVE-2019-8053, CVE-2019-8054, CVE-2019-8055, CVE-2019-8056, CVE-2019-8057, CVE-2019-8058, CVE-2019-8059, CVE-2019-8060, CVE-2019-8061, CVE-2019-8077, CVE-2019-8094, CVE-2019-8095, CVE-2019-8096, CVE-2019-8097, CVE-2019-8098, CVE-2019-8099, CVE-2019-8100, CVE-2019-8101, CVE-2019-8102, CVE-2019-8103, CVE-2019-8104, CVE-2019-8105, CVE-2019-8106, CVE-2019-8237

BID: 108320

IAVA: 2020-A-0211-S