Adobe Acrobat Reader Integer integer overflow

Summaryinfo

A vulnerability classified as critical was found in Adobe Acrobat Reader up to 2015.006.30464/2017.011.30113/2019.010.20069. Affected by this issue is some unknown functionality. The manipulation as part of Integer results in integer overflow. This vulnerability is identified as CVE-2019-7030. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in Adobe Acrobat Reader up to 2015.006.30464/2017.011.30113/2019.010.20069 (Document Reader Software). Affected is an unknown function. The manipulation as part of a Integer leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an integer overflow vulnerability. Successful exploitation could lead to information disclosure.

The bug was discovered 02/12/2019. The weakness was released 02/12/2019 as APSB19-07 as confirmed security bulletin (Website). The advisory is shared for download at helpx.adobe.com. This vulnerability is traded as CVE-2019-7030 since 01/28/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/23/2024).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371638 (Adobe Reader and Acrobat Multiple Security Vulnerabilities (APSB19-07)).

Upgrading to version 2015.006.30475, 2017.011.30120 or 2019.010.20091 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-135564, VDB-135565, VDB-135566 and VDB-135567. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Document Reader Software

Vendor

• Adobe

Name

• Acrobat Reader

Version

• 2015.006.30464
• 2017.011.30113
• 2019.010.20069

License

• free

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion