CVE-2018-15991

Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS v3 8.8 HIGH
CVSS v2.0 9.3 HIGH

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/106164	VDB Entry Third Party Advisory
https://helpx.adobe.com/security/products/acrobat/apsb18-41.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:acrobat_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::classic:::*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:a:adobe:acrobat_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::classic:::*

cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-01-18 17:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-15991

Mitre link : CVE-2018-15991

CVE.ORG link : CVE-2018-15991

JSON object : View

Products Affected

apple

mac_os_x

microsoft

windows

adobe

acrobat_reader_dc
acrobat_dc

CWE

CWE-416

Use After Free

{"id": "CVE-2018-15991", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-01-18T17:29:05.887", "references": [{"url": "http://www.securityfocus.com/bid/106164", "tags": ["VDB Entry", "Third Party Advisory"], "source": "psirt@adobe.com"}, {"url": "https://helpx.adobe.com/security/products/acrobat/apsb18-41.html", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution."}, {"lang": "es", "value": "Adobe Acrobat y Adobe Reader, en las versiones 2019.008.20081 y anteriores, en las 2019.008.20080 y anteriores, en las 2019.008.20081 y anteriores, en las 2017.011.30106 y anteriores, en las 2017.011.30105 y anteriores, en las 2015.006.30457 y anteriores y en las 2015.006.30456 y anteriores, podr\u00edan tener una vulnerabilidad de uso de memoria previamente liberada. La explotaci\u00f3n con \u00e9xito de esta vulnerabilidad podr\u00eda permitir la ejecuci\u00f3n arbitraria de c\u00f3digo."}], "lastModified": "2019-08-21T16:20:23.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "F01FAB9E-7F95-4BD5-B524-F008637A1DCF", "versionEndIncluding": "15.006.30457", "versionStartIncluding": "15.006.30060"}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*", "vulnerable": true, "matchCriteriaId": "8C9E9FC0-F0D7-4EA8-B232-FC8832AB51CD", "versionEndIncluding": "19.008.20081", "versionStartIncluding": "15.008.20082"}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "3EBE609B-95BB-45AF-8583-EAF386D304CD", "versionEndIncluding": "17.011.30106", "versionStartIncluding": "17.011.30059"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "16FBD87F-B4BC-4EE1-8833-11E16142E3A3", "versionEndIncluding": "15.006.30457", "versionStartIncluding": "15.006.30060"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*", "vulnerable": true, "matchCriteriaId": "205830D0-E93E-45A6-9EC6-FCB93D4EF951", "versionEndIncluding": "19.008.20081", "versionStartIncluding": "15.008.20082"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "84DE8099-EC97-4F4B-B672-7ECBFFB4EA83", "versionEndIncluding": "17.011.30106", "versionStartIncluding": "17.011.30059"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "8FB180E5-8772-4EE7-8A0D-3A1BC4BD5C02", "versionEndIncluding": "15.006.30456", "versionStartIncluding": "15.006.30060"}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*", "vulnerable": true, "matchCriteriaId": "9A540D30-F192-41B2-A37E-D85A21363132", "versionEndIncluding": "19.008.20080", "versionStartIncluding": "15.008.20082"}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "645053E1-6269-40E7-9F69-1455AE0BBC0C", "versionEndIncluding": "17.011.30105", "versionStartIncluding": "17.011.30059"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "3F292064-4175-485C-8D52-FD7DCC3E9D07", "versionEndIncluding": "15.006.30456", "versionStartIncluding": "15.006.30060"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*", "vulnerable": true, "matchCriteriaId": "EEAE090A-0856-44FC-8995-1A78194F2F98", "versionEndIncluding": "19.008.20080", "versionStartIncluding": "15.008.200082"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "524B36D5-26A7-4069-9786-B72120FB7309", "versionEndIncluding": "17.011.30105", "versionStartIncluding": "17.011.30059"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4781BF1E-8A4E-4AFF-9540-23D523EE30DD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}