Adobe · Acrobat and Reader
CVE-2023-21608
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
ما هي
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CISA: Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
ما العمل
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
الموعد النهائي للوكالات الفدرالية الأمريكية: 31 أكتوبر 2023
ثغرات مُستغلّة أخرى من Adobe
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 20/05/2026 | Heap-Based Buffer Overflow | Acrobat and Reader | مرتفع 8.8 | 87% |
| 13/04/2026 | Prototype Pollution | Acrobat and Reader | مرتفع 8.6 | 7.2% |
| 14/09/2023 | Out-of-Bounds Write | Acrobat and Reader | مرتفع 7.8 | 6.7% |
| 08/06/2022 | Buffer Overflow | Acrobat and Reader | مرتفع 7.8 | 87% |
| 08/06/2022 | Unspecified | Acrobat and Reader | مرتفع 8.8 | 38% |
| 08/06/2022 | Universal 3D Remote Code Execution | Acrobat and Reader | مرتفع 8.8 | 83% |
| 08/06/2022 | Use-After-Free | Acrobat and Reader | مرتفع 7.8 | 82% |
| 08/06/2022 | Stack-Based Buffer Overflow | Acrobat and Reader | مرتفع 7.3 | 81% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.