A vulnerability classified as problematic has been found in Adobe Acrobat Reader up to 2015.006.30508/2017.011.30156/2019.021.20061 (Document Reader Software). Affected is some unknown functionality. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to memory leak .

The weakness was presented 02/11/2020 as APSB20-05 as confirmed security bulletin (Website). The advisory is available at helpx.adobe.com. This vulnerability is traded as CVE-2020-3756. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 2015.006.30510, 2017.011.30158 or 2020.006.20034 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

See 150124, 150125, 150126 and 150127 for similar entries.

Productinfo

Type

• Document Reader Software

Vendor

• Adobe

Name

• Acrobat Reader

Version

• 2015.006.30508
• 2017.011.30156
• 2019.021.20061

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion