Adobe warns of critical Acrobat and Reader flaws on Windows and macOS

The firm is urging users to update after discovering flaws that could allow arbitrary code execution

Adobe has urged Windows and macOS users to update their Acrobat and Reader applications after discovering that they contained flaws that could be exploited to execute arbitrary code.

Among the critical vulnerabilities are a heap-based buffer overflow (CVE-2020-24435), an arbitrary JavaScript execution (CVE-2020-24432), an out-of-bounds write bug (CVE-2020-24436) and two use-after free flaws (CVE-2020-24430 and CVE-2020-24437).

There are also bugs that allow local privilege escalation, including an improper access control flaw (CVE-2020-24433), a signature-verification bypass problem (CVE-2020-24429) and a race-condition flaw (CVE-2020-24428).

Another severe flaw comes from a security feature bypass that could enable dynamic library injection (CVE-2020-24431).

The flaws affect Acrobat DC and Acrobat Reader DC Continuous versions 2020.012.20048 and earlier; (for Windows and macOS); Acrobat and Acrobat Reader Classic 2020 versions 2020.001.30005 and earlier (for Windows and macOS) and Acrobat and Acrobat Reader Classic 2017 versions 2017.011.30175 and earlier (for Windows and macOS).

Adobe said that users can update applications to Acrobat DC and Acrobat Reader DC Continuous version 2020.013.20064; Acrobat and Acrobat Reader Classic 2020 version 2020.001.30010 and Acrobat and Acrobat Reader Classic 2017 version 2017.011.30180.

The company has also removed all Flash components from its PDF products. In its listing of top new features, the firm said that Flash is now deprecated and no longer used in Acrobat. 

“The various options available in a Form response file that were Flash dependent — Update, Filter, Export (All/Selected), Archive (All/Selected), Add, and Delete — are no longer available. These options are now replaced with the secondary toolbar having options to Update, Add, Delete, Export, and Archive the responses,” read the web page.

In addition, Adobe's PDFMaker menu in Microsoft's Word and PowerPoint apps have lost the Insert Media button. This enabled Office users to embed Flash content in documents.

"By default, Microsoft has disabled the ability to add Flash or Rich media content in the Office documents. If your document already has flash content embedded in it, Acrobat prevents embedding of Flash or Rich media in the converted PDF file and adds an image instead," read the web page.

"If you have enabled the Flash content in Microsoft documents, Acrobat adds a blank box in the converted PDF file."

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Recommended

How do hackers choose their targets?
hacking

How do hackers choose their targets?

17 Sep 2021
Owner of DDoS for hire sites found guilty of hacking offences
distributed denial of service (DDOS)

Owner of DDoS for hire sites found guilty of hacking offences

17 Sep 2021
Microsoft brings passwordless security to consumer accounts
Microsoft Windows

Microsoft brings passwordless security to consumer accounts

16 Sep 2021
Datto launches its business continuity solution for Azure
disaster recovery (DR)

Datto launches its business continuity solution for Azure

15 Sep 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Apple patches zero-day flaw abused by infamous NSO exploit
exploits

Apple patches zero-day flaw abused by infamous NSO exploit

14 Sep 2021
Google takes down map showing homes of 111,000 Guntrader customers
data breaches

Google takes down map showing homes of 111,000 Guntrader customers

2 Sep 2021