Buffer Over-read Vulnerability in Adobe Acrobat and Reader

CVE-2017-16365

Summary

A vulnerability exists in Adobe Acrobat and Reader due to a buffer over-read in the True Type2 Font parsing module. When processing a corrupted cmap table input, the software may perform pointer arithmetic that accesses memory locations outside the allocated buffer. This could allow an attacker to acquire sensitive information, including object heap addresses, which may be leveraged for further exploitation. Affected versions include Adobe Acrobat and Reader 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, as well as 11.0.22 and earlier.

References