Adobe Acrobat and Reader affected by critical flaws

Adobe has released security updates to address twenty-six vulnerabilities in the Adobe Acrobat, Reader, and Lightroom products.

Adobe has released security updates to address tens of vulnerabilities in Adobe Acrobat, Reader, and Lightroom products.

Eleven out of twenty-six flaws are rated as ‘Critical’ because they could be exploited by attackers to remotely execute arbitrary code or bypass security features on vulnerable computers.

APSB20-48 Security updates available for Adobe Acrobat and Reader

Adobe has released security updates that address 25 vulnerabilities in Adobe Acrobat and Reader products, 11 flaws are rated as ‘Critical.’

“Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical and important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.” reads the advisory published by the company.

Below the list of the addressed issues.

Vulnerability CategoryVulnerability ImpactSeverityCVE Number

Disclosure of Sensitive Data	Memory Leak	Important	CVE-2020-9697
Security bypass	Privilege Escalation	Important	CVE-2020-9714
Out-of-bounds write	Arbitrary Code Execution	Critical	CVE-2020-9693CVE-2020-9694
Security bypass	Security feature bypass	Critical	CVE-2020-9696CVE-2020-9712
Stack exhaustion	Application denial-of-service	Important	CVE-2020-9702CVE-2020-9703
Out-of-bounds read	Information disclosure	Important	CVE-2020-9723CVE-2020-9705CVE-2020-9706CVE-2020-9707CVE-2020-9710CVE-2020-9716CVE-2020-9717CVE-2020-9718CVE-2020-9719CVE-2020-9720CVE-2020-9721
Buffer error	Arbitrary Code Execution	Critical	CVE-2020-9698CVE-2020-9699CVE-2020-9700CVE-2020-9701CVE-2020-9704
Use-after-free	Arbitrary Code Execution	Critical	CVE-2020-9715CVE-2020-9722

APSB20-51 Security update available for Adobe Lightroom

Adobe has released a security update to address a DLL hijacking vulnerability in Adobe Lightroom that could be exploited by an attacker to execute commands with elevated privileges.

“Adobe has released updates for Adobe Lightroom Classic for Windows and macOS. This update addresses an important vulnerability. Successful exploitation could lead to privilege escalation in the context of the current user.” reads the advisory.

An attacker can exploit the flaw to get his malicious DLL being loaded at the launching of the software.

Vulnerability Category	Vulnerability Impact	Severity	CVE Numbers
Insecure Library Loading	Privilege escalation	Important	CVE-2020-9724

Adobe has released Lightroom Classic 9.3 to address the vulnerability.

Users of these products are recommended to upgrade to the latest versions as soon as possible.

Pierluigi Paganini

(SecurityAffairs – hacking, Adobe Acrobat)

---