Vulnerabilities > CVE-2018-12756 - Use After Free vulnerability in Adobe Acrobat DC

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

adobe

CWE-416

critical

nessus

NVD

Published: 2018-07-20

Updated: 2019-08-21

Summary

Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vulnerable Configurations

Part	Description	Count
Application	Adobe Adobe Acrobat DC 15.006.30060 Adobe Acrobat DC 15.006.30094 Adobe Acrobat DC 15.006.30096 Adobe Acrobat DC 15.006.30097 Adobe Acrobat DC 15.006.30119 Adobe Acrobat DC 15.006.30121 Adobe Acrobat DC 15.006.30172 Adobe Acrobat DC 15.006.30173 Adobe Acrobat DC 15.006.30174 Adobe Acrobat DC 15.006.30198 Adobe Acrobat DC 15.006.30201 Adobe Acrobat DC 15.006.30243 Adobe Acrobat DC 15.006.30244 Adobe Acrobat DC 15.006.30279 Adobe Acrobat DC 15.006.30280 Adobe Acrobat DC 15.006.30306 Adobe Acrobat DC 15.006.30352 Adobe Acrobat DC 15.006.30354 Adobe Acrobat DC 15.006.30355 Adobe Acrobat DC 15.006.30392 Adobe Acrobat DC 15.006.30394 Adobe Acrobat DC 15.006.30413 Adobe Acrobat DC 15.006.30416 Adobe Acrobat DC 15.006.30417 Adobe Acrobat DC 15.006.30418 Adobe Acrobat DC 15.008.20082 Adobe Acrobat DC 15.009.20069 Adobe Acrobat DC 15.009.20071 Adobe Acrobat DC 15.009.20077 Adobe Acrobat DC 15.009.20079 Adobe Acrobat DC 15.010.20056 Adobe Acrobat DC 15.010.20059 Adobe Acrobat DC 15.010.20060 Adobe Acrobat DC 15.016.20039 Adobe Acrobat DC 15.016.20041 Adobe Acrobat DC 15.016.20045 Adobe Acrobat DC 15.017.20050 Adobe Acrobat DC 15.017.20053 Adobe Acrobat DC 15.020.20039 Adobe Acrobat DC 15.020.20042 Adobe Acrobat DC 15.023.20053 Adobe Acrobat DC 15.023.20056 Adobe Acrobat DC 15.023.20070 Adobe Acrobat DC 17.000.0000 Adobe Acrobat DC 17.009.20044 Adobe Acrobat DC 17.009.20058 Adobe Acrobat DC 17.012.20093 Adobe Acrobat DC 17.012.20095 Adobe Acrobat DC 17.012.20096 Adobe Acrobat DC 17.012.20098 Adobe Acrobat DC 18.0 Adobe Acrobat DC 18.009.20044 Adobe Acrobat DC 18.009.20050 Adobe Acrobat DC 18.011.20035 Adobe Acrobat DC 18.011.20038 Adobe Acrobat DC 18.011.20040 Adobe Acrobat DC 17.011.30059 Adobe Acrobat DC 17.011.30065 Adobe Acrobat DC 17.011.30066 Adobe Acrobat DC 17.011.30068 Adobe Acrobat DC 17.011.30070 Adobe Acrobat DC 17.011.30078 Adobe Acrobat DC 17.011.30079 Adobe Acrobat DC 17.011.30080 Adobe Acrobat Reader DC 15.006.30060 Adobe Acrobat Reader DC 15.006.30094 Adobe Acrobat Reader DC 15.006.30096 Adobe Acrobat Reader DC 15.006.30097 Adobe Acrobat Reader DC 15.006.30119 Adobe Acrobat Reader DC 15.006.30121 Adobe Acrobat Reader DC 15.006.30172 Adobe Acrobat Reader DC 15.006.30173 Adobe Acrobat Reader DC 15.006.30174 Adobe Acrobat Reader DC 15.006.30198 Adobe Acrobat Reader DC 15.006.30201 Adobe Acrobat Reader DC 15.006.30243 Adobe Acrobat Reader DC 15.006.30244 Adobe Acrobat Reader DC 15.006.30279 Adobe Acrobat Reader DC 15.006.30280 Adobe Acrobat Reader DC 15.006.30306 Adobe Acrobat Reader DC 15.006.30352 Adobe Acrobat Reader DC 15.006.30354 Adobe Acrobat Reader DC 15.006.30355 Adobe Acrobat Reader DC 15.006.30392 Adobe Acrobat Reader DC 15.006.30394 Adobe Acrobat Reader DC 15.006.30413 Adobe Acrobat Reader DC 15.006.30416 Adobe Acrobat Reader DC 15.006.30417 Adobe Acrobat Reader DC 15.006.30418 Adobe Acrobat Reader DC 15.008.20082 Adobe Acrobat Reader DC 15.009.20069 Adobe Acrobat Reader DC 15.009.20071 Adobe Acrobat Reader DC 15.009.20077 Adobe Acrobat Reader DC 15.009.20079 Adobe Acrobat Reader DC 15.010.20056 Adobe Acrobat Reader DC 15.010.20059 Adobe Acrobat Reader DC 15.010.20060 Adobe Acrobat Reader DC 15.016.20039 Adobe Acrobat Reader DC 15.016.20041 Adobe Acrobat Reader DC 15.016.20045 Adobe Acrobat Reader DC 15.017.20050 Adobe Acrobat Reader DC 15.017.20053 Adobe Acrobat Reader DC 15.020.20039 Adobe Acrobat Reader DC 15.020.20042 Adobe Acrobat Reader DC 15.023.20053 Adobe Acrobat Reader DC 15.023.20056 Adobe Acrobat Reader DC 15.023.20070 Adobe Acrobat Reader DC 17.000.0000 Adobe Acrobat Reader DC 17.009.20044 Adobe Acrobat Reader DC 17.009.20058 Adobe Acrobat Reader DC 17.012.20093 Adobe Acrobat Reader DC 17.012.20095 Adobe Acrobat Reader DC 17.012.20098 Adobe Acrobat Reader DC 18.0 Adobe Acrobat Reader DC 18.009.20044 Adobe Acrobat Reader DC 18.009.20050 Adobe Acrobat Reader DC 18.011.20035 Adobe Acrobat Reader DC 18.011.20038 Adobe Acrobat Reader DC 18.011.20040 Adobe Acrobat Reader DC 17.011.30059 Adobe Acrobat Reader DC 17.011.30065 Adobe Acrobat Reader DC 17.011.30066 Adobe Acrobat Reader DC 17.011.30068 Adobe Acrobat Reader DC 17.011.30070 Adobe Acrobat Reader DC 17.011.30078 Adobe Acrobat Reader DC 17.011.30079 Adobe Acrobat Reader DC 17.011.30080	127
OS	Apple Apple MAC OS X -	1
OS	Microsoft Microsoft Windows -	1

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Nessus

NASL family	Windows
NASL id	ADOBE_ACROBAT_APSB18-21.NASL
description	The version of Adobe Acrobat installed on the remote Windows host is a version prior to 15.006.30434, 17.011.30096, or 18.011.20055. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	111011
published	2018-07-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111011
title	Adobe Acrobat < 15.006.30434 / 17.011.30096 / 18.011.20055 Multiple Vulnerabilities (APSB18-21)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_ADOBE_READER_APSB18-21.NASL
description	The version of Adobe Reader installed on the remote macOS or Mac OS X host is a version prior to 15.006.30434, 17.011.30096, or 18.011.20055. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	111010
published	2018-07-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111010
title	Adobe Reader < 15.006.30434 / 17.011.30096 / 18.011.20055 Multiple Vulnerabilities (APSB18-21) (macOS)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_ADOBE_ACROBAT_APSB18-21.NASL
description	The version of Adobe Acrobat installed on the remote macOS or Mac OS X host is a version prior to 15.006.30434, 17.011.30096, or 18.011.20055. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	111009
published	2018-07-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111009
title	Adobe Acrobat < 15.006.30434 / 17.011.30096 / 18.011.20055 Multiple Vulnerabilities (APSB18-21) (macOS)

NASL family	Windows
NASL id	ADOBE_READER_APSB18-21.NASL
description	The version of Adobe Reader installed on the remote Windows host is a version prior or equal to 2015.006.30418, 2017.011.30080, or 2018.011.20040. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	111012
published	2018-07-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111012
title	Adobe Reader <= 2015.006.30418 / 2017.011.30080 / 2018.011.20040 Multiple Vulnerabilities (APSB18-21)

Talos

id	TALOS-2018-0590
last seen	2019-05-29
published	2018-07-10
reporter	Talos Intelligence
source	http://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0590
title	Adobe Acrobat Reader DC Collab newWrStreamToCosObj Remote Code Execution Vulnerability

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

Talos

References