Vulnerability CVE-2022-38449

Vulnerability Name:

CVE-2022-38449 (CCN-237883)

Assigned:

2022-10-11

Published:

2022-10-11

Updated:

2022-10-18

Summary:

Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS v3 Severity:

5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-125

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2022-38449

Source: XF
Type: UNKNOWN
adobe-acrobat-cve202238449-info-disc(237883)

Source: CCN
Type: Adobe Security Bulletin APSB22-46
Security update available for Adobe Acrobat and Reader

Source: MISC
Type: Vendor Advisory
https://helpx.adobe.com/security/products/acrobat/apsb22-46.html

Source: CCN
Type: ZDI-22-1430
Adobe Acrobat Reader DC JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* (Version >= 15.008.20082 and < 22.003.20258)

OR cpe:/a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* (Version >= 15.008.20082 and < 22.003.20258)

AND

cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

OR cpe:/o:apple:macos:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* (Version >= 20.001.30005 and < 20.005.30407)

OR cpe:/a:adobe:acrobat:*:*:*:*:classic:*:*:* (Version >= 20.001.30005 and < 20.005.30407)

AND

cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

OR cpe:/o:apple:macos:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK