CVE-2021-21088

Adobe Acrobat Pro DC Use-After-Free Remote Code Execution Vulnerability

Description

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Scores

Faiblesses (CWE)

• CWE-416

Références européennes

• ENISA EUVD · EUVD-2021-8479
• GCVE · GCVE-0-2021-21088

Avis du CERT-FR

• CERTFR-2021-AVI-102 — Multiples vulnérabilités dans Adobe Acrobat et Acrobat Reader · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 17.011.30180 < 17.011.30190
• cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* ≥ 20.001.30005 < 20.001.30020
• cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* ≥ 15.007.20033 < 21.001.20135
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 17.011.30180 < 17.011.30190
• cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* ≥ 20.001.30005 < 20.001.30020
• cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* ≥ 15.007.20033 < 21.001.20135

Produits affectés

Références

• https://helpx.adobe.com/security/products/acrobat/apsb21-09.html

Sources