CVE-2024-39420

Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/acrobat/apsb24-70.html
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2011

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:acrobat:::::classic:::*
	cpe:2.3:a:adobe:acrobat:::::classic:::*
	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_reader:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

21 Nov 2024, 09:27

Type	Values Removed	Values Added
References		() https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2011 -

13 Sep 2024, 09:15

Type	Values Removed	Values Added
Summary		(es) Las versiones de Acrobat Reader 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 y anteriores se ven afectadas por una vulnerabilidad de condición de ejecución de Time-of-check Time-of-use (TOCTOU) que podría resultar en la ejecución de código arbitrario en el contexto. del usuario actual. Este problema ocurre cuando el estado de un recurso cambia entre su tiempo de verificación y su tiempo de uso, lo que permite a un atacante manipular el recurso. La explotación de este problema requiere la interacción del usuario, ya que la víctima debe abrir un archivo malicioso.
Summary	(en) Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when the state of a resource changes between its check-time and use-time, allowing an attacker to manipulate the resource. Exploitation of this issue requires user interaction in that a victim must open a malicious file.	(en) Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
References	~~{'url': 'https://helpx.adobe.com/security/products/acrobat/apsb24-57.html', 'tags': ['Vendor Advisory'], 'source': 'psirt@adobe.com'}~~	() https://helpx.adobe.com/security/products/acrobat/apsb24-70.html -

15 Aug 2024, 17:26

Type	Values Removed	Values Added
First Time		Adobe Adobe acrobat Adobe acrobat Dc Apple macos Apple Microsoft Adobe acrobat Reader Dc Adobe acrobat Reader Microsoft windows
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 7.0
CPE		cpe:2.3:a:adobe:acrobat_dc:::::continuous:::* cpe:2.3:a:adobe:acrobat:::::classic:::* cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:adobe:acrobat_reader:::::classic:::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*
References	~~() https://helpx.adobe.com/security/products/acrobat/apsb24-57.html -~~	() https://helpx.adobe.com/security/products/acrobat/apsb24-57.html - Vendor Advisory

14 Aug 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-14 15:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39420

Mitre link : CVE-2024-39420

CVE.ORG link : CVE-2024-39420

JSON object : View

Products Affected

adobe

acrobat
acrobat_reader
acrobat_dc
acrobat_reader_dc

microsoft

windows

apple

macos

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

7.0 /10