Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Adobe |
|
| Apple |
|
| Microsoft |
|
Configuration 1 [-]
| AND |
|
No data.
References
History
Mon, 16 Sep 2024 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
cvssV3_1
|
Fri, 13 Sep 2024 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 13 Sep 2024 09:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when the state of a resource changes between its check-time and use-time, allowing an attacker to manipulate the resource. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary code execution. This vulnerability arises when the timing of actions changes the state of a resource between the checking of a condition and the use of the resource, allowing an attacker to manipulate the resource in a harmful way. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Title | Talos Security Advisory for Adobe (TALOS-2024-2011) | Acrobat Reader | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) |
| References |
|
Wed, 11 Sep 2024 08:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
|
| References |
| |
| Metrics |
ssvc
|
Thu, 15 Aug 2024 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Apple
Apple macos Microsoft Microsoft windows |
|
| CPEs | cpe:2.3:a:adobe:acrobat:*:*:*:*:classic:*:*:* cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:* cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:classic:*:*:* cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| Vendors & Products |
Apple
Apple macos Microsoft Microsoft windows |
Wed, 14 Aug 2024 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Adobe
Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Adobe acrobat Reader Dc |
|
| CPEs | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* cpe:2.3:a:adobe:acrobat:*:*:*:*:*:macos:*:* cpe:2.3:a:adobe:acrobat:*:*:*:*:*:windows:*:* cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:macos:*:* cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:*:windows:*:* cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:macos:*:* cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:windows:*:* cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:macos:*:* cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:windows:*:* |
|
| Vendors & Products |
Adobe
Adobe acrobat Adobe acrobat Dc Adobe acrobat Reader Adobe acrobat Reader Dc |
|
| Metrics |
ssvc
|
Wed, 14 Aug 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when the state of a resource changes between its check-time and use-time, allowing an attacker to manipulate the resource. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |
| Title | Talos Security Advisory for Adobe (TALOS-2024-2011) | |
| Weaknesses | CWE-367 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: adobe
Published: 2024-08-14T15:07:28.784Z
Updated: 2024-09-16T12:30:11.437Z
Reserved: 2024-06-24T20:32:06.595Z
Link: CVE-2024-39420
Vulnrichment
Updated: 2024-09-10T16:02:47.394Z
NVD
Status : Modified
Published: 2024-08-14T15:15:24.960
Modified: 2024-09-16T13:15:09.977
Link: CVE-2024-39420
Redhat
No data.