deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-17471
Published: 2017-12-08
Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82732140.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82732140; https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82732140
CVE: CVE-2017-17472
Published: 2017-12-08
Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730030.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730030; https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730030
CVE: CVE-2017-17473
Published: 2017-12-08
Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730050.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730050; https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730050
CVE: CVE-2017-17474
Published: 2017-12-08
Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82730070.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730070; https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82730070
CVE: CVE-2017-17475
Published: 2017-12-08
Description: TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact via a \\.\Viragtlt DeviceIoControl request of 0x82736068.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82736068; https://github.com/rubyfly/Vir.IT-explorer_POC/tree/master/0x82736068
CVE: CVE-2017-11940
Published: 2017-12-08
Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, 1709 and Windows Server 2016, Windows Server, version 1709, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to remote code execution. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". This is different than CVE-2017-11937.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102104; http://www.securitytracker.com/id/1039972; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11940
CVE: CVE-2017-10893
Published: 2017-12-08
Description: Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software" Ver3.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://jvn.jp/en/jp/JVN30352845/index.html; https://jvn.jp/en/jp/JVN30352845/index.html
CVE: CVE-2017-10896
Published: 2017-12-08
Description: Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://buffalo.jp/support_s/s20171201.html; https://jvn.jp/en/jp/JVN65994435/index.html; http://buffalo.jp/support_s/s20171201.html
CVE: CVE-2017-10897
Published: 2017-12-08
Description: Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to cause the device to become unresponsive via unspecified vectors.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-20
References: http://buffalo.jp/support_s/s20171201.html; https://jvn.jp/en/jp/JVN65994435/index.html; http://buffalo.jp/support_s/s20171201.html
CVE: CVE-2017-10906
Published: 2017-12-08
Description: Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://access.redhat.com/errata/RHSA-2018:2225; https://github.com/fluent/fluentd/blob/v0.12/CHANGELOG.md#bug-fixes; https://github.com/fluent/fluentd/pull/1733
CVE: CVE-2017-16921
Published: 2017-12-08
Description: In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/162295/OTRS-6.0.1-Remote-Command-Execution.html; https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html; https://www.debian.org/security/2017/dsa-4066
CVE: CVE-2017-12823
Published: 2017-12-08
Description: Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102141; https://support.kaspersky.com/vulnerability.aspx?el=12430#091017; http://www.securityfocus.com/bid/102141
CVE: CVE-2017-15891
Published: 2017-12-08
Description: Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.synology.com/en-global/support/security/Synology_SA_17_68_Calendar; https://www.synology.com/en-global/support/security/Synology_SA_17_68_Calendar
CVE: CVE-2017-15893
Published: 2017-12-08
Description: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology File Station before 1.1.1-0099 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.synology.com/en-global/support/security/Synology_SA_17_69_File_Station; https://www.synology.com/en-global/support/security/Synology_SA_17_69_File_Station
CVE: CVE-2017-15894
Published: 2017-12-08
Description: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.synology.com/en-global/support/security/Synology_SA_17_70_DSM; https://www.synology.com/en-global/support/security/Synology_SA_17_70_DSM
CVE: CVE-2017-15895
Published: 2017-12-08
Description: Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.synology.com/en-global/support/security/Synology_SA_17_71_SRM; https://www.synology.com/en-global/support/security/Synology_SA_17_71_SRM
CVE: CVE-2017-16854
Published: 2017-12-08
Description: In Open Ticket Request System (OTRS) through 3.3.20, 4 through 4.0.26, 5 through 5.0.24, and 6 through 6.0.1, an attacker who is logged in as a customer can use the ticket search form to disclose internal article information of their customer tickets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://lists.debian.org/debian-lts-announce/2017/12/msg00015.html; https://www.debian.org/security/2017/dsa-4066; https://www.otrs.com/security-advisory-2017-08-security-update-otrs-framework/
CVE: CVE-2017-11480
Published: 2017-12-08
Description: Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://discuss.elastic.co/t/beats-5-6-4-security-update/106739; https://discuss.elastic.co/t/beats-5-6-4-security-update/106739
CVE: CVE-2017-11481
Published: 2017-12-08
Description: Kibana versions prior to 6.0.1 and 5.6.5 had a cross-site scripting (XSS) vulnerability via URL fields that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571; https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571
CVE: CVE-2017-11482
Published: 2017-12-08
Description: The Kibana fix for CVE-2017-8451 was found to be incomplete. With X-Pack installed, Kibana versions before 6.0.1 and 5.6.5 have an open redirect vulnerability on the login page that would enable an attacker to craft a link that redirects to an arbitrary website.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571; https://discuss.elastic.co/t/kibana-6-0-1-and-5-6-5-security-update/110571
CVE: CVE-2017-17479
Published: 2017-12-08
Description: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/uclouvain/openjpeg/issues/1044; https://github.com/uclouvain/openjpeg/issues/1044
CVE: CVE-2017-17480
Published: 2017-12-08
Description: In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/uclouvain/openjpeg/issues/1044; https://lists.debian.org/debian-lts-announce/2018/11/msg00018.html; https://usn.ubuntu.com/4109-1/
CVE: CVE-2017-11213
Published: 2017-12-09
Description: An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer due to an integer overflow; the computation is part of the abstraction that creates an arbitrarily sized transparent or opaque bitmap image. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: http://www.securityfocus.com/bid/101837; http://www.securitytracker.com/id/1039778; https://access.redhat.com/errata/RHSA-2017:3222
CVE: CVE-2017-11215
Published: 2017-12-09
Description: An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101837; http://www.securitytracker.com/id/1039778; https://access.redhat.com/errata/RHSA-2017:3222
CVE: CVE-2017-11225
Published: 2017-12-09
Description: An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101837; http://www.securitytracker.com/id/1039778; https://access.redhat.com/errata/RHSA-2017:3222
CVE: CVE-2017-11273
Published: 2017-12-09
Description: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. Adobe Digital Editions parses crafted XML files in an unsafe manner, which could lead to sensitive information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101839; http://www.securitytracker.com/id/1039798; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-39.html
CVE: CVE-2017-11287
Published: 2017-12-09
Description: An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A reflected cross-site scripting vulnerability exists that can result in information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101838; http://www.securitytracker.com/id/1039799; https://helpx.adobe.com/security/products/connect/apsb17-35.html
CVE: CVE-2017-11288
Published: 2017-12-09
Description: An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A reflected cross-site scripting vulnerability exists that can result in information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101838; http://www.securitytracker.com/id/1039799; https://helpx.adobe.com/security/products/connect/apsb17-35.html
CVE: CVE-2017-11289
Published: 2017-12-09
Description: An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A reflected cross-site scripting vulnerability exists that can result in information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101838; http://www.securitytracker.com/id/1039799; https://helpx.adobe.com/security/products/connect/apsb17-35.html
CVE: CVE-2017-11290
Published: 2017-12-09
Description: An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A UI Redress (or Clickjacking) vulnerability exists. This issue has been resolved by adding a feature that enables Connect administrators to protect users from UI redressing (or clickjacking) attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: http://www.securityfocus.com/bid/101838; http://www.securitytracker.com/id/1039799; https://helpx.adobe.com/security/products/connect/apsb17-35.html
CVE: CVE-2017-11291
Published: 2017-12-09
Description: An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A Server-Side Request Forgery (SSRF) vulnerability exists that could be abused to bypass network access controls.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-918
References: http://www.securityfocus.com/bid/101838; http://www.securitytracker.com/id/1039799; https://helpx.adobe.com/security/products/connect/apsb17-35.html
CVE: CVE-2017-11293
Published: 2017-12-09
Description: An issue was discovered in Adobe Acrobat and Reader: 2[PII_REDACTED]8 and earlier versions, 2[PII_REDACTED]6 and earlier versions, 2[PII_REDACTED]5 and earlier versions, and 11.0.22 and earlier versions. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102140; http://www.securitytracker.com/id/1039791; https://helpx.adobe.com/security/products/acrobat/aspb17-36.html
CVE: CVE-2017-11294
Published: 2017-12-09
Description: An issue was discovered in Adobe Shockwave 12.2.9.199 and earlier. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101836; http://www.securitytracker.com/id/1039784; https://helpx.adobe.com/security/products/shockwave/apsb17-40.html
CVE: CVE-2017-11295
Published: 2017-12-09
Description: An issue was discovered in Adobe DNG Converter 9.12.1 and earlier versions. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101828; https://helpx.adobe.com/security/products/dng-converter/apsb17-37.html; http://www.securityfocus.com/bid/101828
CVE: CVE-2017-11296
Published: 2017-12-09
Description: An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. A cross-site scripting vulnerability in Apache Sling Servlets Post 2.3.20 has been resolved in Adobe Experience Manager.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101844; http://www.securitytracker.com/id/1039800; https://helpx.adobe.com/security/products/experience-manager/apsb17-41.html
CVE: CVE-2017-11297
Published: 2017-12-09
Description: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which could lead to disclosure of memory addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101839; http://www.securitytracker.com/id/1039798; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-39.html
CVE: CVE-2017-11298
Published: 2017-12-09
Description: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which could lead to disclosure of memory addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101839; http://www.securitytracker.com/id/1039798; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-39.html
CVE: CVE-2017-11299
Published: 2017-12-09
Description: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which could lead to disclosure of memory addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101839; http://www.securitytracker.com/id/1039798; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-39.html
CVE: CVE-2017-11300
Published: 2017-12-09
Description: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which could lead to disclosure of memory addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101839; http://www.securitytracker.com/id/1039798; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-39.html
CVE: CVE-2017-11301
Published: 2017-12-09
Description: An issue was discovered in Adobe Digital Editions 4.5.6 and earlier versions. An exploitable memory corruption vulnerability exists, which could lead to disclosure of memory addresses.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101839; http://www.securitytracker.com/id/1039798; https://helpx.adobe.com/security/products/Digital-Editions/apsb17-39.html
CVE: CVE-2017-11302
Published: 2017-12-09
Description: An issue was discovered in Adobe InDesign 12.1.0 and earlier versions. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101840; http://www.securitytracker.com/id/1039785; https://helpx.adobe.com/security/products/indesign/apsb17-38.html
CVE: CVE-2017-11303
Published: 2017-12-09
Description: An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101829; http://www.securitytracker.com/id/1039786; https://helpx.adobe.com/security/products/photoshop/apsb17-34.html
CVE: CVE-2017-11304
Published: 2017-12-09
Description: An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. An exploitable use-after-free vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101829; http://www.securitytracker.com/id/1039786; https://helpx.adobe.com/security/products/photoshop/apsb17-34.html
CVE: CVE-2017-16360
Published: 2017-12-09
Description: An issue was discovered in Adobe Acrobat and Reader: 2[PII_REDACTED]8 and earlier versions, 2[PII_REDACTED]6 and earlier versions, 2[PII_REDACTED]5 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the MakeAccessible plugin, when creating an internal data structure. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101818; http://www.securitytracker.com/id/1039791; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-16361
Published: 2017-12-09
Description: An issue was discovered in Adobe Acrobat and Reader: 2[PII_REDACTED]8 and earlier versions, 2[PII_REDACTED]6 and earlier versions, 2[PII_REDACTED]5 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of a security bypass vulnerability when handling XFDF files.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/101830; http://www.securitytracker.com/id/1039791; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-16362
Published: 2017-12-09
Description: An issue was discovered in Adobe Acrobat and Reader: 2[PII_REDACTED]8 and earlier versions, 2[PII_REDACTED]6 and earlier versions, 2[PII_REDACTED]5 and earlier versions, and 11.0.22 and earlier versions. This vulnerability is an instance of an out of bounds read vulnerability in the MakeAccesible plugin, when handling font data. It causes an out of bounds memory access, which sometimes triggers an access violation exception. Attackers can exploit the vulnerability by using the out of bounds access for unintended reads, writes, or frees, potentially leading to code corruption, control-flow hijack, or an information leak attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102140; http://www.securitytracker.com/id/1039791; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
CVE: CVE-2017-16363
Published: 2017-12-09
Description: An issue was discovered in Adobe Acrobat and Reader: 2[PII_REDACTED]8 and earlier versions, 2[PII_REDACTED]6 and earlier versions, 2[PII_REDACTED]5 and earlier versions, and 11.0.22 and earlier versions. The vulnerability is caused by a buffer over-read in the module that handles character codes for certain textual representations. Invalid input leads to a computation where the pointer arithmetic results in a location outside valid memory locations belonging to the buffer. An attack can be used to obtain sensitive information, such as object heap addresses, etc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/101824; http://www.securitytracker.com/id/1039791; https://helpx.adobe.com/security/products/acrobat/apsb17-36.html