Vulnerability CVE-2019-7806


Published: 2019-05-22

Description:
Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Type:

CWE-416

(Use After Free)

Vendor: Adobe
Product: Acrobat dc 
Version:
18.011.20063
18.011.20055
18.009.20050
18.009.20044
17.012.20098
17.012.20096
17.012.20095
17.012.20093
17.009.20058
17.009.20044
15.023.20070
15.023.20056
15.023.20053
15.020.20042
15.020.20039
15.017.20053
15.017.20050
15.016.20045
15.016.20041
15.016.20039
15.010.20060
15.010.20059
15.010.20056
15.009.20079
15.009.20077
15.009.20071
15.009.20069
15.008.20082
15.006.30482
15.006.30475
15.006.30464
15.006.30457
15.006.30456
15.006.30452
15.006.30448
15.006.30434
15.006.30418
15.006.30417
15.006.30416
15.006.30413
See more versions on NVD
Product: Acrobat reader dc 
Version:
18.011.20063
18.011.20055
18.011.20040
18.011.20038
18.009.20050
18.009.20044
17.012.20098
17.012.20095
17.012.20093
17.009.20058
17.009.20044
15.023.20070
15.023.20056
15.023.20053
15.020.20042
15.020.20039
15.017.20053
15.017.20050
15.016.20045
15.016.20041
15.016.20039
15.010.20060
15.010.20059
15.010.20056
15.009.20079
15.009.20077
15.009.20071
15.009.20069
15.008.20082
15.006.30482
15.006.30475
15.006.30464
15.006.30461
15.006.30457
15.006.30456
15.006.30452
15.006.30448
15.006.30434
15.006.30418
15.006.30417
15.006.30416
See more versions on NVD
Product: Acrobat 
Version:
17.011.30120
17.011.30113
17.011.30110
17.011.30106
17.011.30105
17.011.30102
17.011.30099
17.011.30096
17.011.30080
17.011.30079
17.011.30078
17.011.30070
17.011.30068
17.011.30065
17.011.30059
17.011.30056
See more versions on NVD
Product: Acrobat reader 
Version:
17.011.30102
17.011.30096
17.011.30059
See more versions on NVD

CVSS2 => (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
10/10
10/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete

 References:
http://www.securityfocus.com/bid/108320
https://helpx.adobe.com/security/products/acrobat/apsb19-18.html

Related CVE
CVE-2019-7845
Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7840
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7839
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7838
ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7129
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-7816
ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7815
Adobe Acrobat and Reader versions 2019.010.20091 and earlier, 2019.010.20091 and earlier, 2017.011.30120 and earlier version, and 2015.006.30475 and earlier have a data leakage (sensitive) vulnerability. Successful exploitation could lead to informat...
CVE-2019-7095
Adobe Digital Editions versions 4.5.10.185749 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.

Copyright 2019, cxsecurity.com

 

Back to Top