CVE-2020-24438: Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory a...

Summary

Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a maliciou...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
adobe	acrobat	<= 20.001.30005 `cpe:2.3:a:adobe:acrobat:::::classic:::*`
adobe	acrobat_dc	<= 17.011.30175 <= 20.012.20048 `cpe:2.3:a:adobe:acrobat_dc:::::classic:::*`
adobe	acrobat_reader	<= 20.001.30005 `cpe:2.3:a:adobe:acrobat_reader:::::classic:::*`
adobe	acrobat_reader_dc	<= 17.011.30175 <= 20.012.20048 `cpe:2.3:a:adobe:acrobat_reader_dc:::::classic:::*`

Original advisory text

Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory a...

Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

References

https://helpx.adobe.com/security/products/acrobat/apsb20-67.html Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1357/ Third Party Advisory VDB Entry