CVE-2017-3009

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow vulnerability in the JPEG2000 parser. Successful exploitation could lead to information disclosure.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/97302	Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb17-01.html	Vendor Advisory
http://www.securityfocus.com/bid/97302	Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/acrobat/apsb17-01.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:acrobat::::::::
	cpe:2.3:a:adobe:acrobat_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_dc:::::continuous:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::classic:::*
	cpe:2.3:a:adobe:acrobat_reader_dc:::::continuous:::*
	cpe:2.3:a:adobe:reader::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2017-03-31 16:59

Updated : 2025-04-20 01:37

NVD link : CVE-2017-3009

Mitre link : CVE-2017-3009

CVE.ORG link : CVE-2017-3009

JSON object : View

Products Affected

adobe

acrobat_reader_dc
acrobat_dc
acrobat
reader

apple

macos

microsoft

windows

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2017-3009", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-03-31T16:59:00.520", "references": [{"url": "http://www.securityfocus.com/bid/97302", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@adobe.com"}, {"url": "https://helpx.adobe.com/security/products/acrobat/apsb17-01.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}, {"url": "http://www.securityfocus.com/bid/97302", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://helpx.adobe.com/security/products/acrobat/apsb17-01.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow vulnerability in the JPEG2000 parser. Successful exploitation could lead to information disclosure."}, {"lang": "es", "value": "Adobe Acrobat Reader versiones 15.020.20042 y en versiones anteriores a 15.006.30244 y en versiones anteriores a 11.0.18 y versiones anteriores tienen una vulnerabilidad explotable de desbordamiento de b\u00fafer en el analizador JPEG2000. Una explotaci\u00f3n exitosa podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79C92CAE-E238-4450-A9D1-6AD35F006BD1", "versionEndIncluding": "11.0.18", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "A5543934-84E5-4927-850D-ADEFCE150E77", "versionEndIncluding": "15.006.30244", "versionStartIncluding": "15.000.0000"}, {"criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*", "vulnerable": true, "matchCriteriaId": "7D2CC936-AACB-42DA-95F6-C2567E209DF2", "versionEndIncluding": "15.020.20042", "versionStartIncluding": "15.000.0000"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "E23E66EF-B335-473B-8895-9F392B9FA1CE", "versionEndIncluding": "15.006.30244", "versionStartIncluding": "15.000.0000"}, {"criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*", "vulnerable": true, "matchCriteriaId": "DCE94D04-159C-400F-B2E7-532BBFD1B1BB", "versionEndIncluding": "15.020.20042", "versionStartIncluding": "15.000.0000"}, {"criteria": "cpe:2.3:a:adobe:reader:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0755CB59-C529-42FF-8CC3-0595D3B440EE", "versionEndIncluding": "11.0.18", "versionStartIncluding": "11.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}