Vulnerability Details : CVE-2018-4901
An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the document identity representation. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code.
Vulnerability category: Memory CorruptionExecute code
Products affected by CVE-2018-4901
- cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*
- Adobe » Acrobat Dc » Continuous EditionVersions from including (>=) - and up to, including, (<=) 18.009.20050cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*
- Adobe » Acrobat Dc » Classic EditionVersions from including (>=) 15.0 and up to, including, (<=) 15.006.30394cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*
- Adobe » Acrobat Reader Dc » Continuous EditionVersions from including (>=) - and up to, including, (<=) 18.009.20050cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*
- Adobe » Acrobat Reader Dc » Classic EditionVersions from including (>=) 15.0 and up to, including, (<=) 15.006.30394cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-4901
13.68%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-4901
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2018-4901
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-4901
-
http://www.securitytracker.com/id/1040364
Adobe Acrobat/Reader Multiple Bugs Let Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/102994
Adobe Acrobat and Reader APSB18-02 Multiple Remote Code Execution VulnerabilitiesThird Party Advisory;VDB Entry
-
https://helpx.adobe.com/security/products/acrobat/apsb18-02.html
Adobe Security BulletinVendor Advisory
Jump to