Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2017-11243: Adobe Acrobat Reader lets attackers run code
CVE-2017-11243 · published 9 years ago
Summary
Versions of Adobe Acrobat Reader listed above contain a bug that can let an attacker cause the program to run any code they choose. This could let them take control of a computer that opens a malicious PDF. Install the latest Adobe Acrobat Reader update as soon as possible to protect your systems.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | acrobat |
>= 11.0.0, <= 11.0.20 >= 17.011.00000, <= 17.011.30066 cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
| adobe | acrobat_dc |
>= 15.006.30060, <= 15.006.30306 >= 15.007.20033, <= 17.009.20058 cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:* |
| adobe | acrobat_reader |
>= 17.011.00000, <= 17.011.30066 cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* |
| adobe | acrobat_reader_dc |
>= 15.006.30060, <= 15.006.30306 >= 15.007.20033, <= 17.009.20058 cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:* |
| adobe | reader |
>= 11.0.0, <= 11.0.20 cpe:2.3:a:adobe:reader:*:*:*:*:*:*:*:* |
Original advisory text
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the XSLT engin...
Adobe Acrobat Reader 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier has an exploitable memory corruption vulnerability in the XSLT engine. Successful exploitation could lead to arbitrary code execution.
References
- http://www.securityfocus.com/bid/100184 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1039098 Third Party Advisory VDB Entry
- https://helpx.adobe.com/security/products/acrobat/apsb17-24.html Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-119Buffer Overflow
Timeline
Published11 Aug 2017
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-11243 · NVD
Track software like this
Free during beta