Vulnerabilities > CVE-2019-8160 - Cross-site Scripting vulnerability in Adobe Acrobat DC

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

adobe

CWE-79

nessus

NVD

Published: 2019-10-17

Updated: 2019-10-22

Summary

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information disclosure.

Vulnerable Configurations

Part	Description	Count
Application	Adobe Adobe Acrobat DC 15.006.30060 Adobe Acrobat DC 15.006.30094 Adobe Acrobat DC 15.006.30096 Adobe Acrobat DC 15.006.30097 Adobe Acrobat DC 15.006.30119 Adobe Acrobat DC 15.006.30121 Adobe Acrobat DC 15.006.30172 Adobe Acrobat DC 15.006.30173 Adobe Acrobat DC 15.006.30174 Adobe Acrobat DC 15.006.30198 Adobe Acrobat DC 15.006.30201 Adobe Acrobat DC 15.006.30243 Adobe Acrobat DC 15.006.30244 Adobe Acrobat DC 15.006.30279 Adobe Acrobat DC 15.006.30280 Adobe Acrobat DC 15.006.30306 Adobe Acrobat DC 15.006.30352 Adobe Acrobat DC 15.006.30354 Adobe Acrobat DC 15.006.30355 Adobe Acrobat DC 15.006.30392 Adobe Acrobat DC 15.006.30394 Adobe Acrobat DC 15.006.30413 Adobe Acrobat DC 15.006.30416 Adobe Acrobat DC 15.006.30417 Adobe Acrobat DC 15.006.30418 Adobe Acrobat DC 15.006.30434 Adobe Acrobat DC 15.006.30448 Adobe Acrobat DC 15.006.30452 Adobe Acrobat DC 15.006.30456 Adobe Acrobat DC 15.006.30457 Adobe Acrobat DC 15.006.30464 Adobe Acrobat DC 15.006.30475 Adobe Acrobat DC 15.006.30482 Adobe Acrobat DC 15.006.30493 Adobe Acrobat DC 15.006.30495 Adobe Acrobat DC 15.006.30497 Adobe Acrobat DC 15.006.30498 Adobe Acrobat DC 15.006.30499 Adobe Acrobat DC 15.008.20082 Adobe Acrobat DC 15.009.20069 Adobe Acrobat DC 15.009.20071 Adobe Acrobat DC 15.009.20077 Adobe Acrobat DC 15.009.20079 Adobe Acrobat DC 15.010.20056 Adobe Acrobat DC 15.010.20059 Adobe Acrobat DC 15.010.20060 Adobe Acrobat DC 15.016.20039 Adobe Acrobat DC 15.016.20041 Adobe Acrobat DC 15.016.20045 Adobe Acrobat DC 15.017.20050 Adobe Acrobat DC 15.017.20053 Adobe Acrobat DC 15.020.20039 Adobe Acrobat DC 15.020.20042 Adobe Acrobat DC 15.023.20053 Adobe Acrobat DC 15.023.20056 Adobe Acrobat DC 15.023.20070 Adobe Acrobat DC 17.000.0000 Adobe Acrobat DC 17.009.20044 Adobe Acrobat DC 17.009.20058 Adobe Acrobat DC 17.012.20093 Adobe Acrobat DC 17.012.20095 Adobe Acrobat DC 17.012.20096 Adobe Acrobat DC 17.012.20098 Adobe Acrobat DC 18.0 Adobe Acrobat DC 18.009.20044 Adobe Acrobat DC 18.009.20050 Adobe Acrobat DC 18.011.20035 Adobe Acrobat DC 18.011.20038 Adobe Acrobat DC 18.011.20040 Adobe Acrobat DC 18.011.20055 Adobe Acrobat DC 18.011.20058 Adobe Acrobat DC 18.011.20063 Adobe Acrobat DC 19.008.20071 Adobe Acrobat DC 19.008.20074 Adobe Acrobat DC 19.008.20080 Adobe Acrobat DC 19.008.20081 Adobe Acrobat DC 19.010.20064 Adobe Acrobat DC 19.010.20069 Adobe Acrobat DC 19.010.20091 Adobe Acrobat DC 19.010.20098 Adobe Acrobat DC 19.010.20099 Adobe Acrobat DC 19.010.20100 Adobe Acrobat DC 19.012.20034 Adobe Acrobat DC 19.012.20035 Adobe Acrobat DC 19.012.20036 Adobe Acrobat DC 17.011.30059 Adobe Acrobat DC 17.011.30065 Adobe Acrobat DC 17.011.30066 Adobe Acrobat DC 17.011.30068 Adobe Acrobat DC 17.011.30070 Adobe Acrobat DC 17.011.30078 Adobe Acrobat DC 17.011.30079 Adobe Acrobat DC 17.011.30080 Adobe Acrobat DC 17.011.30096 Adobe Acrobat DC 17.011.30099 Adobe Acrobat DC 17.011.30102 Adobe Acrobat DC 17.011.30105 Adobe Acrobat DC 17.011.30106 Adobe Acrobat DC 17.011.30110 Adobe Acrobat DC 17.011.30113 Adobe Acrobat DC 17.011.30120 Adobe Acrobat DC 17.011.30127 Adobe Acrobat DC 17.011.30138 Adobe Acrobat DC 17.011.30140 Adobe Acrobat DC 17.011.30142 Adobe Acrobat DC 17.011.30143 Adobe Acrobat DC 17.011.30144 Adobe Acrobat Reader DC 15.006.30060 Adobe Acrobat Reader DC 15.006.30094 Adobe Acrobat Reader DC 15.006.30096 Adobe Acrobat Reader DC 15.006.30097 Adobe Acrobat Reader DC 15.006.30119 Adobe Acrobat Reader DC 15.006.30121 Adobe Acrobat Reader DC 15.006.30172 Adobe Acrobat Reader DC 15.006.30173 Adobe Acrobat Reader DC 15.006.30174 Adobe Acrobat Reader DC 15.006.30198 Adobe Acrobat Reader DC 15.006.30201 Adobe Acrobat Reader DC 15.006.30243 Adobe Acrobat Reader DC 15.006.30244 Adobe Acrobat Reader DC 15.006.30279 Adobe Acrobat Reader DC 15.006.30280 Adobe Acrobat Reader DC 15.006.30306 Adobe Acrobat Reader DC 15.006.30352 Adobe Acrobat Reader DC 15.006.30354 Adobe Acrobat Reader DC 15.006.30355 Adobe Acrobat Reader DC 15.006.30392 Adobe Acrobat Reader DC 15.006.30394 Adobe Acrobat Reader DC 15.006.30413 Adobe Acrobat Reader DC 15.006.30416 Adobe Acrobat Reader DC 15.006.30417 Adobe Acrobat Reader DC 15.006.30418 Adobe Acrobat Reader DC 15.006.30434 Adobe Acrobat Reader DC 15.006.30448 Adobe Acrobat Reader DC 15.006.30452 Adobe Acrobat Reader DC 15.006.30456 Adobe Acrobat Reader DC 15.006.30457 Adobe Acrobat Reader DC 15.006.30461 Adobe Acrobat Reader DC 15.006.30464 Adobe Acrobat Reader DC 15.006.30475 Adobe Acrobat Reader DC 15.006.30482 Adobe Acrobat Reader DC 15.006.30493 Adobe Acrobat Reader DC 15.006.30495 Adobe Acrobat Reader DC 15.006.30497 Adobe Acrobat Reader DC 15.006.30498 Adobe Acrobat Reader DC 15.006.30499 Adobe Acrobat Reader DC 15.008.20082 Adobe Acrobat Reader DC 15.009.20069 Adobe Acrobat Reader DC 15.009.20071 Adobe Acrobat Reader DC 15.009.20077 Adobe Acrobat Reader DC 15.009.20079 Adobe Acrobat Reader DC 15.010.20056 Adobe Acrobat Reader DC 15.010.20059 Adobe Acrobat Reader DC 15.010.20060 Adobe Acrobat Reader DC 15.016.20039 Adobe Acrobat Reader DC 15.016.20041 Adobe Acrobat Reader DC 15.016.20045 Adobe Acrobat Reader DC 15.017.20050 Adobe Acrobat Reader DC 15.017.20053 Adobe Acrobat Reader DC 15.020.20039 Adobe Acrobat Reader DC 15.020.20042 Adobe Acrobat Reader DC 15.023.20053 Adobe Acrobat Reader DC 15.023.20056 Adobe Acrobat Reader DC 15.023.20070 Adobe Acrobat Reader DC 17.000.0000 Adobe Acrobat Reader DC 17.009.20044 Adobe Acrobat Reader DC 17.009.20058 Adobe Acrobat Reader DC 17.012.20093 Adobe Acrobat Reader DC 17.012.20095 Adobe Acrobat Reader DC 17.012.20098 Adobe Acrobat Reader DC 18.0 Adobe Acrobat Reader DC 18.009.20044 Adobe Acrobat Reader DC 18.009.20050 Adobe Acrobat Reader DC 18.011.20035 Adobe Acrobat Reader DC 18.011.20038 Adobe Acrobat Reader DC 18.011.20040 Adobe Acrobat Reader DC 18.011.20055 Adobe Acrobat Reader DC 18.011.20063 Adobe Acrobat Reader DC 19.008.20071 Adobe Acrobat Reader DC 19.008.20074 Adobe Acrobat Reader DC 19.008.20080 Adobe Acrobat Reader DC 19.008.20081 Adobe Acrobat Reader DC 19.010.20064 Adobe Acrobat Reader DC 19.010.20069 Adobe Acrobat Reader DC 19.010.20091 Adobe Acrobat Reader DC 19.010.20098 Adobe Acrobat Reader DC 19.010.20099 Adobe Acrobat Reader DC 19.010.20100 Adobe Acrobat Reader DC 19.012.20034 Adobe Acrobat Reader DC 19.012.20035 Adobe Acrobat Reader DC 19.012.20036 Adobe Acrobat Reader DC 17.011.30059 Adobe Acrobat Reader DC 17.011.30065 Adobe Acrobat Reader DC 17.011.30066 Adobe Acrobat Reader DC 17.011.30068 Adobe Acrobat Reader DC 17.011.30070 Adobe Acrobat Reader DC 17.011.30078 Adobe Acrobat Reader DC 17.011.30079 Adobe Acrobat Reader DC 17.011.30080 Adobe Acrobat Reader DC 17.011.30096 Adobe Acrobat Reader DC 17.011.30099 Adobe Acrobat Reader DC 17.011.30102 Adobe Acrobat Reader DC 17.011.30105 Adobe Acrobat Reader DC 17.011.30106 Adobe Acrobat Reader DC 17.011.30110 Adobe Acrobat Reader DC 17.011.30113 Adobe Acrobat Reader DC 17.011.30120 Adobe Acrobat Reader DC 17.011.30127 Adobe Acrobat Reader DC 17.011.30138 Adobe Acrobat Reader DC 17.011.30140 Adobe Acrobat Reader DC 17.011.30142 Adobe Acrobat Reader DC 17.011.30143 Adobe Acrobat Reader DC 17.011.30144	213
OS	Apple Apple MAC OS X -	1
OS	Microsoft Microsoft Windows -	1

Common Weakness Enumeration (CWE)

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Common Attack Pattern Enumeration and Classification (CAPEC)

Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Embedding Scripts in Non-Script Elements
This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
Embedding Scripts within Scripts
An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
Cross-Site Scripting in Error Pages
An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
Cross-Site Scripting Using Alternate Syntax
The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.

Nessus

NASL family	MacOS X Local Security Checks
NASL id	MACOS_ADOBE_READER_APSB19-49.NASL
description	The version of Adobe Reader installed on the remote macOS host is a version prior or equal to 2015.006.30503, 2017.011.30148, or 2019.012.20040. It is, therefore, affected by multiple vulnerabilities. - Out-of-Bounds Read potentially leading to Information Disclosure (CVE-2019-8064, CVE-2019-8163, CVE-2019-8164, CVE-2019-8168, CVE-2019-8172, CVE-2019-8173, CVE-2019-8182, CVE-2019-8184, CVE-2019-8185, CVE-2019-8189, CVE-2019-8190, CVE-2019-8193, CVE-2019-8194, CVE-2019-8198, CVE-2019-8201, CVE-2019-8202, CVE-2019-8204, CVE-2019-8207, CVE-2019-8216, CVE-2019-8218, CVE-2019-8222) - Out-of-Bounds Write potentially leading to Arbitrary Code Execution (CVE-2019-8165, CVE-2019-8171, CVE-2019-8186, CVE-2019-8191, CVE-2019-8199, CVE-2019-8206) - Use After Free potentially leading to Arbitrary Code Execution (CVE-2019-8175, CVE-2019-8176, CVE-2019-8177, CVE-2019-8178, CVE-2019-8179, CVE-2019-8180, CVE-2019-8181, CVE-2019-8187, CVE-2019-8188, CVE-2019-8192, CVE-2019-8203, CVE-2019-8208, CVE-2019-8209, CVE-2019-8210, CVE-2019-8211, CVE-2019-8212, CVE-2019-8213, CVE-2019-8214, CVE-2019-8215, CVE-2019-8217, CVE-2019-8219, CVE-2019-8220, CVE-2019-8221, CVE-2019-8223, CVE-2019-8224, CVE-2019-8225) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	129976
published	2019-10-16
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/129976
title	Adobe Reader <= 2015.006.30503 / 2017.011.30148 / 2019.012.20040 Multiple Vulnerabilities (APSB19-49) (macOS)
code	# # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(129976); script_version("1.5"); script_cvs_date("Date: 2019/12/13"); script_cve_id( "CVE-2019-8064", "CVE-2019-8160", "CVE-2019-8161", "CVE-2019-8162", "CVE-2019-8163", "CVE-2019-8164", "CVE-2019-8165", "CVE-2019-8166", "CVE-2019-8167", "CVE-2019-8168", "CVE-2019-8169", "CVE-2019-8170", "CVE-2019-8171", "CVE-2019-8172", "CVE-2019-8173", "CVE-2019-8174", "CVE-2019-8175", "CVE-2019-8176", "CVE-2019-8177", "CVE-2019-8178", "CVE-2019-8179", "CVE-2019-8180", "CVE-2019-8181", "CVE-2019-8182", "CVE-2019-8183", "CVE-2019-8184", "CVE-2019-8185", "CVE-2019-8186", "CVE-2019-8187", "CVE-2019-8188", "CVE-2019-8189", "CVE-2019-8190", "CVE-2019-8191", "CVE-2019-8192", "CVE-2019-8193", "CVE-2019-8194", "CVE-2019-8195", "CVE-2019-8196", "CVE-2019-8197", "CVE-2019-8198", "CVE-2019-8199", "CVE-2019-8200", "CVE-2019-8201", "CVE-2019-8202", "CVE-2019-8203", "CVE-2019-8204", "CVE-2019-8205", "CVE-2019-8206", "CVE-2019-8207", "CVE-2019-8208", "CVE-2019-8209", "CVE-2019-8210", "CVE-2019-8211", "CVE-2019-8212", "CVE-2019-8213", "CVE-2019-8214", "CVE-2019-8215", "CVE-2019-8216", "CVE-2019-8217", "CVE-2019-8218", "CVE-2019-8219", "CVE-2019-8220", "CVE-2019-8221", "CVE-2019-8222", "CVE-2019-8223", "CVE-2019-8224", "CVE-2019-8225", "CVE-2019-8226" ); script_name(english:"Adobe Reader <= 2015.006.30503 / 2017.011.30148 / 2019.012.20040 Multiple Vulnerabilities (APSB19-49) (macOS)"); script_summary(english:"Checks the version of Adobe Reader."); script_set_attribute(attribute:"synopsis", value: "The version of Adobe Reader installed on the remote macOS host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Adobe Reader installed on the remote macOS host is a version prior or equal to 2015.006.30503, 2017.011.30148, or 2019.012.20040. It is, therefore, affected by multiple vulnerabilities. - Out-of-Bounds Read potentially leading to Information Disclosure (CVE-2019-8064, CVE-2019-8163, CVE-2019-8164, CVE-2019-8168, CVE-2019-8172, CVE-2019-8173, CVE-2019-8182, CVE-2019-8184, CVE-2019-8185, CVE-2019-8189, CVE-2019-8190, CVE-2019-8193, CVE-2019-8194, CVE-2019-8198, CVE-2019-8201, CVE-2019-8202, CVE-2019-8204, CVE-2019-8207, CVE-2019-8216, CVE-2019-8218, CVE-2019-8222) - Out-of-Bounds Write potentially leading to Arbitrary Code Execution (CVE-2019-8165, CVE-2019-8171, CVE-2019-8186, CVE-2019-8191, CVE-2019-8199, CVE-2019-8206) - Use After Free potentially leading to Arbitrary Code Execution (CVE-2019-8175, CVE-2019-8176, CVE-2019-8177, CVE-2019-8178, CVE-2019-8179, CVE-2019-8180, CVE-2019-8181, CVE-2019-8187, CVE-2019-8188, CVE-2019-8192, CVE-2019-8203, CVE-2019-8208, CVE-2019-8209, CVE-2019-8210, CVE-2019-8211, CVE-2019-8212, CVE-2019-8213, CVE-2019-8214, CVE-2019-8215, CVE-2019-8217, CVE-2019-8219, CVE-2019-8220, CVE-2019-8221, CVE-2019-8223, CVE-2019-8224, CVE-2019-8225) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); # https://helpx.adobe.com/security/products/acrobat/apsb19-49.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20b7a288"); script_set_attribute(attribute:"solution", value: "Upgrade to Adobe Reader version 2015.006.30504 or 2017.011.30150 or 2019.021.20047 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-8171"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/15"); script_set_attribute(attribute:"patch_publication_date", value:"2019/10/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/16"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:acrobat_reader"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_adobe_reader_installed.nasl"); script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "installed_sw/Adobe Reader"); exit(0); } include('vcf.inc'); include('vcf_extras.inc'); get_kb_item_or_exit('Host/local_checks_enabled'); os = get_kb_item('Host/MacOSX/Version'); if (empty_or_null(os)) audit(AUDIT_OS_NOT, 'Mac OS X'); app_info = vcf::get_app_info(app:'Adobe Reader'); # vcf::adobe_reader::check_version_and_report will # properly separate tracks when checking constraints. # x.y.30zzz = DC Classic # x.y.20zzz = DC Continuous constraints = [ { 'min_version' : '15.6', 'max_version' : '15.006.30503', 'fixed_version' : '15.006.30504' }, { 'min_version' : '17.8', 'max_version' : '17.011.30148', 'fixed_version' : '17.011.30150' }, { 'min_version' : '15.7', 'max_version' : '19.012.20040', 'fixed_version' : '19.021.20047' } ]; vcf::adobe_reader::check_version_and_report( app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, max_segs:3 );

NASL family	MacOS X Local Security Checks
NASL id	MACOS_ADOBE_ACROBAT_APSB19-49.NASL
description	The version of Adobe Acrobat installed on the remote macOS host is a version prior or equal to 2015.006.30503, 2017.011.30148, or 2019.012.20040. It is, therefore, affected by multiple vulnerabilities. - Out-of-Bounds Read potentially leading to Information Disclosure (CVE-2019-8064, CVE-2019-8163, CVE-2019-8164, CVE-2019-8168, CVE-2019-8172, CVE-2019-8173, CVE-2019-8182, CVE-2019-8184, CVE-2019-8185, CVE-2019-8189, CVE-2019-8190, CVE-2019-8193, CVE-2019-8194, CVE-2019-8198, CVE-2019-8201, CVE-2019-8202, CVE-2019-8204, CVE-2019-8207, CVE-2019-8216, CVE-2019-8218, CVE-2019-8222) - Out-of-Bounds Write potentially leading to Arbitrary Code Execution (CVE-2019-8165, CVE-2019-8171, CVE-2019-8186, CVE-2019-8191, CVE-2019-8199, CVE-2019-8206) - Use After Free potentially leading to Arbitrary Code Execution (CVE-2019-8175, CVE-2019-8176, CVE-2019-8177, CVE-2019-8178, CVE-2019-8179, CVE-2019-8180, CVE-2019-8181, CVE-2019-8187, CVE-2019-8188, CVE-2019-8192, CVE-2019-8203, CVE-2019-8208, CVE-2019-8209, CVE-2019-8210, CVE-2019-8211, CVE-2019-8212, CVE-2019-8213, CVE-2019-8214, CVE-2019-8215, CVE-2019-8217, CVE-2019-8219, CVE-2019-8220, CVE-2019-8221, CVE-2019-8223, CVE-2019-8224, CVE-2019-8225) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	129975
published	2019-10-16
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/129975
title	Adobe Acrobat <= 2015.006.30503 / 2017.011.30148 / 2019.012.20040 Multiple Vulnerabilities (APSB19-49) (macOS)

NASL family	Windows
NASL id	ADOBE_ACROBAT_APSB19-49.NASL
description	The version of Adobe Acrobat installed on the remote Windows host is a version prior or equal to 2015.006.30503, 2017.011.30148, or 2019.012.20040. It is, therefore, affected by multiple vulnerabilities. - Out-of-Bounds Read potentially leading to Information Disclosure (CVE-2019-8064, CVE-2019-8163, CVE-2019-8164, CVE-2019-8168, CVE-2019-8172, CVE-2019-8173, CVE-2019-8182, CVE-2019-8184, CVE-2019-8185, CVE-2019-8189, CVE-2019-8190, CVE-2019-8193, CVE-2019-8194, CVE-2019-8198, CVE-2019-8201, CVE-2019-8202, CVE-2019-8204, CVE-2019-8207, CVE-2019-8216, CVE-2019-8218, CVE-2019-8222) - Out-of-Bounds Write potentially leading to Arbitrary Code Execution (CVE-2019-8165, CVE-2019-8171, CVE-2019-8186, CVE-2019-8191, CVE-2019-8199, CVE-2019-8206) - Use After Free potentially leading to Arbitrary Code Execution (CVE-2019-8175, CVE-2019-8176, CVE-2019-8177, CVE-2019-8178, CVE-2019-8179, CVE-2019-8180, CVE-2019-8181, CVE-2019-8187, CVE-2019-8188, CVE-2019-8192, CVE-2019-8203, CVE-2019-8208, CVE-2019-8209, CVE-2019-8210, CVE-2019-8211, CVE-2019-8212, CVE-2019-8213, CVE-2019-8214, CVE-2019-8215, CVE-2019-8217, CVE-2019-8219, CVE-2019-8220, CVE-2019-8221, CVE-2019-8223, CVE-2019-8224, CVE-2019-8225) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	129977
published	2019-10-16
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/129977
title	Adobe Acrobat <= 2015.006.30503 / 2017.011.30148 / 2019.012.20040 Multiple Vulnerabilities (APSB19-49)

NASL family	Windows
NASL id	ADOBE_READER_APSB19-49.NASL
description	The version of Adobe Reader installed on the remote Windows host is a version prior or equal to 2015.006.30503, 2017.011.30148, or 2019.012.20040. It is, therefore, affected by multiple vulnerabilities. - Out-of-Bounds Read potentially leading to Information Disclosure (CVE-2019-8064, CVE-2019-8163, CVE-2019-8164, CVE-2019-8168, CVE-2019-8172, CVE-2019-8173, CVE-2019-8182, CVE-2019-8184, CVE-2019-8185, CVE-2019-8189, CVE-2019-8190, CVE-2019-8193, CVE-2019-8194, CVE-2019-8198, CVE-2019-8201, CVE-2019-8202, CVE-2019-8204, CVE-2019-8207, CVE-2019-8216, CVE-2019-8218, CVE-2019-8222) - Out-of-Bounds Write potentially leading to Arbitrary Code Execution (CVE-2019-8165, CVE-2019-8171, CVE-2019-8186, CVE-2019-8191, CVE-2019-8199, CVE-2019-8206) - Use After Free potentially leading to Arbitrary Code Execution (CVE-2019-8175, CVE-2019-8176, CVE-2019-8177, CVE-2019-8178, CVE-2019-8179, CVE-2019-8180, CVE-2019-8181, CVE-2019-8187, CVE-2019-8188, CVE-2019-8192, CVE-2019-8203, CVE-2019-8208, CVE-2019-8209, CVE-2019-8210, CVE-2019-8211, CVE-2019-8212, CVE-2019-8213, CVE-2019-8214, CVE-2019-8215, CVE-2019-8217, CVE-2019-8219, CVE-2019-8220, CVE-2019-8221, CVE-2019-8223, CVE-2019-8224, CVE-2019-8225) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	129978
published	2019-10-16
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/129978
title	Adobe Reader <= 2015.006.30503 / 2017.011.30148 / 2019.012.20040 Multiple Vulnerabilities (APSB19-49)

References

https://helpx.adobe.com/security/products/acrobat/apsb19-49.html