Headline
CVE-2023-21614: Adobe Security Bulletin
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security update available for Adobe Acrobat and Reader | APSB23-01
Bulletin ID
Date Published
Priority
APSB23-01
January 10, 2023
3
Summary
Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical and important vulnerabilities. Successful exploitation could lead to application denial-of-service, arbitrary code execution, privilege escalation and memory leak.
Affected Versions
Product
Track
Affected Versions
Platform
Acrobat DC
Continuous
22.003.20282 (Win), 22.003.20281 (Mac) and earlier versions
Windows & macOS
Acrobat Reader DC
Continuous
22.003.20282 (Win), 22.003.20281 (Mac) and earlier versions
Windows & macOS
Acrobat 2020
Classic 2020
20.005.30418 and earlier versions
Windows & macOS
Acrobat Reader 2020
Classic 2020
20.005.30418 and earlier versions
Windows & macOS
For questions regarding Acrobat DC, please visit the Acrobat DC FAQ page.
For questions regarding Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page.
Solution
Adobe recommends users update their software installations to the latest versions by following the instructions below.
The latest product versions are available to end users via one of the following methods:
Users can update their product installations manually by choosing Help > Check for Updates.
The products will update automatically, without requiring user intervention, when updates are detected.
The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.
For IT administrators (managed environments):
Refer to the specific release note version for links to installers.
Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on macOS, Apple Remote Desktop and SSH.
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:
Product
Track
Updated Versions
Platform
Priority Rating
Availability
Acrobat DC
Continuous
22.003.20310
Windows and macOS
3
Release Notes
Acrobat Reader DC
Continuous
22.003.20310
Windows and macOS
3
Release Notes
Acrobat 2020
Classic 2020
20.005.30436
Windows and macOS
3
Release Notes
Acrobat Reader 2020
Classic 2020
20.005.30436
Windows and macOS
3
Release Notes
Vulnerability Details
Vulnerability Category
Vulnerability Impact
Severity
CVSS base score
CVSS vector
CVE Number
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21579
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2023-21581
Out-of-bounds Read (CWE-125)
Memory Leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2023-21585
NULL Pointer Dereference (CWE-476)
Application denial-of-service
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2023-21586
Stack-based Buffer Overflow (CWE-121)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21604
Heap-based Buffer Overflow (CWE-122)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21605
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21606
Improper Input Validation (CWE-20)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21607
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21608
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21609
Stack-based Buffer Overflow (CWE-121)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVE-2023-21610
Violation of Secure Design Principles (CWE-657)
Privilege escalation
Important
6.4
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21611
Violation of Secure Design Principles (CWE-657)
Privilege escalation
Important
5.6
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
CVE-2023-21612
Out-of-bounds Read (CWE-125)
Memory leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2023-21613
Out-of-bounds Read (CWE-125)
Memory leak
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2023-21614
Acknowledgements
Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:
0x1byte working with Trend Micro Zero Day Initiative - CVE-2023-21579, CVE-2023-21581, CVE-2023-21605
Koh M. Nakagawa (Ko Kato) (tsunekoh) - CVE-2023-21611, CVE-2023-21612
Mat Powell with Trend Micro Zero Day Initiative - CVE-2023-21585, CVE-2023-21606, CVE-2023-21607, CVE-2023-21613, CVE-2023-21614
KMFL (kmfl) - CVE-2023-21586
Anonymous working with Trend Micro Zero Day Initiative - CVE-2023-21609
Vancir (vancir) - CVE-2023-21610
Ashfaq Ansari and Krishnakant Patil - HackSys Inc working with Trend Micro Zero Day Initiative- CVE-2023-21608
Revisions:
November 7, 2022: Revised acknowledgement for CVE-2022-38437
For more information, visit https://helpx.adobe.com/security.html, or email [email protected].
Related news
CISA flags use-after-free bug now being exploited in the wild.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a high-severity flaw in Adobe Acrobat Reader to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Tracked as CVE-2023-21608 (CVSS score: 7.8), the vulnerability has been described as a use-after-free bug that can be exploited to achieve remote code execution (RCE) with the
Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.