Vulnerability-Lookup

CVE-2024-39425 (GCVE-0-2024-39425)

Vulnerability from cvelistv5 – Published: 2024-08-14 15:07 – Updated: 2024-08-15 03:55

Title

Security vulnerability in AdobeARMHelper

Summary

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-14 00:00 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

Assigner

adobe CNA under the mitre root

CNA scorecard C 75/100 over 817 records in the last 180 days details

References

1 reference

URL	Tags
https://helpx.adobe.com/security/products/acrobat…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version	CPE status
Adobe	Acrobat Reader	Affected: 0 , ≤ 24.001.30123 (semver)	guessed
adobe	acrobat_dc	Affected: 0 , ≤ 24.002.20991 (semver) cpe:2.3:a:adobe:acrobat_dc::::::windows::*
adobe	acrobat_dc	Affected: 0 , ≤ 24.002.20964 (semver) cpe:2.3:a:adobe:acrobat_dc::::::macos::*
adobe	acrobat	Affected: 0 , ≤ 24.001.30123 (custom) cpe:2.3:a:adobe:acrobat::::::::
adobe	acrobat	Affected: 0 , ≤ 24.001.30123 (semver) Affected: 20.0 , ≤ 20.005.30636 (semver) cpe:2.3:a:adobe:acrobat::::::windows::*
adobe	acrobat	Affected: 0 , ≤ 24.001.30123 (semver) Affected: 20.0 , ≤ 20.005.30635 (semver) cpe:2.3:a:adobe:acrobat::::::macos::*
adobe	acrobat_reader	Affected: 0 , ≤ 20.005.30636 (custom) cpe:2.3:a:adobe:acrobat_reader::::::windows::*
adobe	acrobat_reader	Affected: 0 , ≤ 20.005.30635 (custom) cpe:2.3:a:adobe:acrobat_reader::::::macos::*
adobe	acrobat_reader_dc	Affected: 0 , ≤ 24.002.20964 (semver) cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:macos::
adobe	acrobat_reader_dc	Affected: 0 , ≤ 24.002.20991 (semver) cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:windows::

Date Public

2024-08-13 17:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat_dc",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.002.20991",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat_dc",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.002.20964",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.001.30123",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.001.30123",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "20.005.30636",
                "status": "affected",
                "version": "20.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.001.30123",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "20.005.30635",
                "status": "affected",
                "version": "20.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat_reader",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "20.005.30636",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat_reader",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "20.005.30635",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat_reader_dc",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.002.20964",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
            ],
            "defaultStatus": "affected",
            "product": "acrobat_reader_dc",
            "vendor": "adobe",
            "versions": [
              {
                "lessThanOrEqual": "24.002.20991",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39425",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-15T03:55:56.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Acrobat Reader",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30123",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-08-13T17:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "environmentalScore": 7,
            "environmentalSeverity": "HIGH",
            "exploitCodeMaturity": "NOT_DEFINED",
            "integrityImpact": "HIGH",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "HIGH",
            "modifiedAttackVector": "LOCAL",
            "modifiedAvailabilityImpact": "HIGH",
            "modifiedConfidentialityImpact": "HIGH",
            "modifiedIntegrityImpact": "HIGH",
            "modifiedPrivilegesRequired": "LOW",
            "modifiedScope": "NOT_DEFINED",
            "modifiedUserInteraction": "NONE",
            "privilegesRequired": "LOW",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-14T15:07:23.644Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Security vulnerability in AdobeARMHelper"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2024-39425",
    "datePublished": "2024-08-14T15:07:23.644Z",
    "dateReserved": "2024-06-24T20:32:06.595Z",
    "dateUpdated": "2024-08-15T03:55:56.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-39425",
      "date": "2026-10-29",
      "epss": "0.00202",
      "percentile": "0.10187"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "affected",
                "product": "Acrobat Reader",
                "vendor": "Adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@adobe.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20991",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20964",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "20.005.30636",
                    "status": "affected",
                    "version": "20.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "20.005.30635",
                    "status": "affected",
                    "version": "20.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "20.005.30636",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "20.005.30635",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20964",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20991",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
                    "matchCriteriaId": "B9311FEC-D9CC-421C-8E5E-8131E460FC42",
                    "versionEndExcluding": "20.005.30655",
                    "versionStartIncluding": "20.001.30005",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
                    "matchCriteriaId": "1A09E4B8-DB3B-45EC-B441-2C9549D299B1",
                    "versionEndExcluding": "24.001.30159",
                    "versionStartIncluding": "24.001.20604",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
                    "matchCriteriaId": "D555A6CB-9EDF-4CA2-B8E5-04A9D212FD8B",
                    "versionEndExcluding": "24.002.21005",
                    "versionStartIncluding": "15.008.20082",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*",
                    "matchCriteriaId": "883444C8-35EB-4BDF-A14C-C4C5BF97239A",
                    "versionEndExcluding": "20.005.30655",
                    "versionStartIncluding": "20.001.3005",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
                    "matchCriteriaId": "9CE03784-4780-4313-A27A-37B265BF3F9D",
                    "versionEndExcluding": "24.002.21005",
                    "versionStartIncluding": "15.008.20082",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high."
          },
          {
            "lang": "es",
            "value": " Las versiones de Acrobat Reader 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 y anteriores se ven afectadas por una vulnerabilidad de condici\u00f3n de ejecuci\u00f3n de Time-of-check Time-of-use (TOCTOU) que podr\u00eda provocar una escalada de privilegios. La explotaci\u00f3n de este problema requiere acceso local con pocos privilegios al sistema afectado y la complejidad del ataque es alta."
          }
        ],
        "id": "CVE-2024-39425",
        "lastModified": "2026-06-17T07:41:54.993",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "psirt@adobe.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-39425",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-14T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-08-14T15:15:25.883",
        "references": [
          {
            "source": "psirt@adobe.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
          }
        ],
        "sourceIdentifier": "psirt@adobe.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-367"
              }
            ],
            "source": "psirt@adobe.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T18:46:48+00:00",
      "cve": "CVE-2024-39425",
      "id": "CVE-2024-39425",
      "initial_release_date": "2024-08-13T17:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Security vulnerability in AdobeARMHelper",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-39425.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20991",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20964",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "20.005.30636",
                    "status": "affected",
                    "version": "20.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.001.30123",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "20.005.30635",
                    "status": "affected",
                    "version": "20.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "20.005.30636",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "20.005.30635",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20964",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
                ],
                "defaultStatus": "affected",
                "product": "acrobat_reader_dc",
                "vendor": "adobe",
                "versions": [
                  {
                    "lessThanOrEqual": "24.002.20991",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-39425",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-08-14T15:53:58.082264Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-08-14T15:55:55.391Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "product": "Acrobat Reader",
              "vendor": "Adobe",
              "versions": [
                {
                  "lessThanOrEqual": "24.001.30123",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "datePublic": "2024-08-13T17:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "environmentalScore": 7,
                "environmentalSeverity": "HIGH",
                "exploitCodeMaturity": "NOT_DEFINED",
                "integrityImpact": "HIGH",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "HIGH",
                "modifiedAttackVector": "LOCAL",
                "modifiedAvailabilityImpact": "HIGH",
                "modifiedConfidentialityImpact": "HIGH",
                "modifiedIntegrityImpact": "HIGH",
                "modifiedPrivilegesRequired": "LOW",
                "modifiedScope": "NOT_DEFINED",
                "modifiedUserInteraction": "NONE",
                "privilegesRequired": "LOW",
                "remediationLevel": "NOT_DEFINED",
                "reportConfidence": "NOT_DEFINED",
                "scope": "UNCHANGED",
                "temporalScore": 7,
                "temporalSeverity": "HIGH",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-08-14T15:07:23.644Z",
            "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
            "shortName": "adobe"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Security vulnerability in AdobeARMHelper"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "assignerShortName": "adobe",
        "cveId": "CVE-2024-39425",
        "datePublished": "2024-08-14T15:07:23.644Z",
        "dateReserved": "2024-06-24T20:32:06.595Z",
        "dateUpdated": "2024-08-15T03:55:56.990Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2024-09618 (CVE-2024-39425)

Vulnerability from fstec – Published: 2024-11-15 – Updated: 2024-11-15 – View on bdu.fstec.ru Fixed

Title

Уязвимость программы просмотра и редактирования PDF-файлов Acrobat Reader, связанная с ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю повысить свои привилегии

Summary

Уязвимость программы просмотра и редактирования PDF-файлов Acrobat Reader связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии

Severity

6.0 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:S/C:C/I:C/A:C

7.0 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Timing and state manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-367 - Ситуация гонки Time-of-check Time-of-use (TOCTOU)

Aliases

CVE-2024-39425

References

3 references

URL
https://nvd.nist.gov/vuln/detail/CVE-2024-39425
https://feedly.com/cve/CVE-2024-39425
https://helpx.adobe.com/security/products/acrobat/apsb24-57.html

Impacted products

5 products from 1 vendor

Vendors

Adobe Systems Inc.

Products

Adobe Acrobat Document Cloud, Adobe Acrobat 2024, Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat Reader Document Cloud

Versions

до 24.002.21005 Continuous (Adobe Acrobat Document Cloud), до 24.001.30159 Classic 2024 (Adobe Acrobat 2024), до 20.005.30655 Classic 2020 (Adobe Acrobat 2020), до 20.005.30655 Classic 2020 (Adobe Acrobat Reader 2020), до 24.002.21005 Continuous (Adobe Acrobat Reader Document Cloud)

Product types

Application software

Platforms

Microsoft Corp Windows -, Apple Inc. MacOS -

Mitigations

Использование рекомендаций: https://helpx.adobe.com/security/products/acrobat/apsb24-57.html

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Adobe Systems Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 24.002.21005 Continuous (Adobe Acrobat Document Cloud), \u0434\u043e 24.001.30159 Classic 2024 (Adobe Acrobat 2024), \u0434\u043e 20.005.30655 Classic 2020 (Adobe Acrobat 2020), \u0434\u043e 20.005.30655 Classic 2020 (Adobe Acrobat Reader 2020), \u0434\u043e 24.002.21005 Continuous (Adobe Acrobat Reader Document Cloud)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: \nhttps://helpx.adobe.com/security/products/acrobat/apsb24-57.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.08.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "15.11.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "15.11.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-09618",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-39425",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Adobe Acrobat Document Cloud, Adobe Acrobat 2024, Adobe Acrobat 2020, Adobe Acrobat Reader 2020, Adobe Acrobat Reader Document Cloud",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Microsoft Corp Windows - , Apple Inc. MacOS - ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f PDF-\u0444\u0430\u0439\u043b\u043e\u0432 Acrobat Reader, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0433\u043e\u043d\u043a\u0438 Time-of-check Time-of-use (TOCTOU) (CWE-367)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f PDF-\u0444\u0430\u0439\u043b\u043e\u0432 Acrobat Reader \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425\nhttps://feedly.com/cve/CVE-2024-39425\nhttps://helpx.adobe.com/security/products/acrobat/apsb24-57.html",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-367",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7)"
}

CERTFR-2024-AVI-0678

Vulnerability from certfr_avis - Published: 2024-08-14 - Updated: 2024-08-14

De multiples vulnérabilités ont été découvertes dans les produits Adobe. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Adobe	Acrobat	Acrobat 2020 versions antérieures à 20.005.30655
Adobe	Magento	Magento Open Source versions 2.4.5.x antérieures à 2.4.5-p9
Adobe	Acrobat	Acrobat DC versions antérieures à 24.002.21005
Adobe	Commerce	Commerce versions antérieures à 2.4.4-p10
Adobe	Commerce	Commerce versions 2.4.7.x antérieures à 2.4.7-p2
Adobe	Commerce	Commerce versions 2.4.6.x antérieures à 2.4.6-p7
Adobe	Commerce	Commerce versions 2.4.5.x antérieures à 2.4.5-p9
Adobe	Magento	Magento Open Source versions 2.4.6.x antérieures à 2.4.6-p7
Adobe	Acrobat	Acrobat 2024 versions antérieures à 24.001.30159
Adobe	Magento	Magento Open Source versions 2.4.7.x antérieures à 2.4.7-p2
Adobe	Magento	Magento Open Source versions antérieures à 2.4.4-p10
Adobe	Acrobat Reader	Acrobat Reader DC versions antérieures à 24.002.21005
Adobe	Acrobat Reader	Acrobat Reader 2020 versions antérieures à 20.005.30655

References

Title

Publication Time

CNVD-2024-39289

Vulnerability from cnvd - Published: 2024-09-25

Title

Adobe Acrobat Reader存在未明漏洞（CNVD-2024-39289）

Description

Adobe Acrobat Reader是美国奥多比（Adobe）公司的一款PDF查看器。该软件用于打印，签名和注释PDF。 Adobe Acrobat Reader存在安全漏洞。攻击者可利用该漏洞导致提升权限。

Severity

中

Patch Name

Adobe Acrobat Reader存在未明漏洞（CNVD-2024-39289）的补丁

Patch Description

Adobe Acrobat Reader是美国奥多比（Adobe）公司的一款PDF查看器。该软件用于打印，签名和注释PDF。 Adobe Acrobat Reader存在安全漏洞。攻击者可利用该漏洞导致提升权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://helpx.adobe.com/security/products/acrobat/apsb24-57.html

Reference

https://nvd.nist.gov/vuln/detail/CVE-2024-39425

Impacted products

Name
['Adobe acrobat classic >=20.001.30005，<20.005.30655', 'Adobe acrobat classic >=24.001.20604，<24.001.30159', 'Adobe Acrobat DC Continuous >=15.008.20082，<24.002.21005', 'Adobe acrobat reader classic >=20.001.3005，<20.005.30655', 'Adobe acrobat reader dc continuous >=15.008.20082，<24.002.21005']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-39425",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425"
    }
  },
  "description": "Adobe Acrobat Reader\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u6b3ePDF\u67e5\u770b\u5668\u3002\u8be5\u8f6f\u4ef6\u7528\u4e8e\u6253\u5370\uff0c\u7b7e\u540d\u548c\u6ce8\u91caPDF\u3002\n\nAdobe Acrobat Reader\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u63d0\u5347\u6743\u9650\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://helpx.adobe.com/security/products/acrobat/apsb24-57.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-39289",
  "openTime": "2024-09-25",
  "patchDescription": "Adobe Acrobat Reader\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4e00\u6b3ePDF\u67e5\u770b\u5668\u3002\u8be5\u8f6f\u4ef6\u7528\u4e8e\u6253\u5370\uff0c\u7b7e\u540d\u548c\u6ce8\u91caPDF\u3002\r\n\r\nAdobe Acrobat Reader\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u63d0\u5347\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Adobe Acrobat Reader\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-39289\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe acrobat classic \u003e=20.001.30005\uff0c\u003c20.005.30655",
      "Adobe acrobat classic \u003e=24.001.20604\uff0c\u003c24.001.30159",
      "Adobe Acrobat DC Continuous \u003e=15.008.20082\uff0c\u003c24.002.21005",
      "Adobe acrobat reader classic \u003e=20.001.3005\uff0c\u003c20.005.30655",
      "Adobe acrobat reader dc continuous \u003e=15.008.20082\uff0c\u003c24.002.21005"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425",
  "serverity": "\u4e2d",
  "submitTime": "2024-08-16",
  "title": "Adobe Acrobat Reader\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-39289\uff09"
}

FKIE_CVE-2024-39425

Vulnerability from fkie_nvd - Published: 2024-08-14 15:15 - Updated: 2026-06-17 07:41

Severity

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	psirt@adobe.com	https://helpx.adobe.com/security/products/acrobat/apsb24-57.html	Vendor Advisory

Impacted products

Vendor	Product	Version
adobe	acrobat	*
adobe	acrobat	*
adobe	acrobat_dc	*
adobe	acrobat_reader	*
adobe	acrobat_reader_dc	*
apple	macos	-
microsoft	windows	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "Acrobat Reader",
          "vendor": "Adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30123",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@adobe.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat_dc",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.002.20991",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat_dc",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.002.20964",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30123",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30123",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "20.005.30636",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.001.30123",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "20.005.30635",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat_reader",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "20.005.30636",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat_reader",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "20.005.30635",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat_reader_dc",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.002.20964",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:*"
          ],
          "defaultStatus": "affected",
          "product": "acrobat_reader_dc",
          "vendor": "adobe",
          "versions": [
            {
              "lessThanOrEqual": "24.002.20991",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "B9311FEC-D9CC-421C-8E5E-8131E460FC42",
              "versionEndExcluding": "20.005.30655",
              "versionStartIncluding": "20.001.30005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "1A09E4B8-DB3B-45EC-B441-2C9549D299B1",
              "versionEndExcluding": "24.001.30159",
              "versionStartIncluding": "24.001.20604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
              "matchCriteriaId": "D555A6CB-9EDF-4CA2-B8E5-04A9D212FD8B",
              "versionEndExcluding": "24.002.21005",
              "versionStartIncluding": "15.008.20082",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:*",
              "matchCriteriaId": "883444C8-35EB-4BDF-A14C-C4C5BF97239A",
              "versionEndExcluding": "20.005.30655",
              "versionStartIncluding": "20.001.3005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
              "matchCriteriaId": "9CE03784-4780-4313-A27A-37B265BF3F9D",
              "versionEndExcluding": "24.002.21005",
              "versionStartIncluding": "15.008.20082",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high."
    },
    {
      "lang": "es",
      "value": " Las versiones de Acrobat Reader 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 y anteriores se ven afectadas por una vulnerabilidad de condici\u00f3n de ejecuci\u00f3n de Time-of-check Time-of-use (TOCTOU) que podr\u00eda provocar una escalada de privilegios. La explotaci\u00f3n de este problema requiere acceso local con pocos privilegios al sistema afectado y la complejidad del ataque es alta."
    }
  ],
  "id": "CVE-2024-39425",
  "lastModified": "2026-06-17T07:41:54.993",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39425",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-08-14T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-08-14T15:15:25.883",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "psirt@adobe.com",
      "type": "Secondary"
    }
  ]
}

GHSA-8P32-H9GR-3VRR

Vulnerability from github – Published: 2024-08-14 15:31 – Updated: 2024-08-14 15:31

Details

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39425"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-14T15:15:25Z",
    "severity": "HIGH"
  },
  "details": "Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.",
  "id": "GHSA-8p32-h9gr-3vrr",
  "modified": "2024-08-14T15:31:18Z",
  "published": "2024-08-14T15:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39425"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb24-57.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2024-0347

Vulnerability from csaf_ncscnl - Published: 2024-08-14 12:52 - Updated: 2024-08-14 12:52

Summary

Kwetsbaarheden verholpen in Adobe Acrobat en Acrobat Reader

Scope

12 vulnerabilities in this advisory, including CVE-2024-39425.

CVE-2024-39425

7.5 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Known affected: 5 products

Open the full advisory

WID-SEC-W-2024-1833

Vulnerability from csaf_certbund - Published: 2024-08-13 22:00 - Updated: 2024-12-01 23:00

Summary

Adobe Acrobat Reader: Mehrere Schwachstellen

Severity

Hoch

Scope

14 vulnerabilities in this advisory, including CVE-2024-39425.

CVE-2024-39425

Es bestehen mehrere Schwachstellen in Adobe Acrobat Reader DC, Adobe Acrobat Reader, Adobe Acrobat DC und Adobe Acrobat. Diese Fehler bestehen aufgrund verschiedener sicherheitsrelevanter Probleme, wie z. B. einem Use-after-free, einem Out-of-bound-Write oder einer unsachgemäßen Überprüfung der kryptografischen Signatur. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.

Known affected: 5 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-39425 (GCVE-0-2024-39425)

BDU:2024-09618 (CVE-2024-39425)

CERTFR-2024-AVI-0678

Solutions

CNVD-2024-39289

FKIE_CVE-2024-39425

GHSA-8P32-H9GR-3VRR

NCSC-2024-0347

WID-SEC-W-2024-1833

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour