CVE-2017-2960 : What You Need to Know

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have a memory corruption vulnerability in the image conversion engine due to incorrect parsing of EXIF metadata, potentially leading to arbitrary code execution.

Understanding CVE-2017-2960

There is a memory corruption vulnerability in Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier, allowing for the execution of arbitrary code if successfully exploited.

What is CVE-2017-2960?

This CVE refers to a memory corruption vulnerability in Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier, caused by incorrect parsing of EXIF metadata.

The Impact of CVE-2017-2960

If exploited, this vulnerability could result in the execution of arbitrary code on the affected system, potentially leading to unauthorized access or control.

Technical Details of CVE-2017-2960

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier are susceptible to a memory corruption vulnerability.

Vulnerability Description

The vulnerability stems from the incorrect parsing of EXIF metadata in the image conversion engine of Adobe Acrobat Reader, allowing attackers to potentially execute arbitrary code.

Affected Systems and Versions

Adobe Acrobat Reader 15.020.20042 and earlier
Adobe Acrobat Reader 15.006.30244 and earlier
Adobe Acrobat Reader 11.0.18 and earlier

Exploitation Mechanism

Attackers can exploit this vulnerability by crafting malicious files containing specially-crafted EXIF metadata, which upon processing by Adobe Acrobat Reader, could trigger the execution of arbitrary code.

Mitigation and Prevention

To address CVE-2017-2960, users and organizations should take immediate and long-term security measures.

Immediate Steps to Take

Update Adobe Acrobat Reader to the latest version available.
Exercise caution when opening files from untrusted or unknown sources.
Implement security best practices to minimize the risk of exploitation.

Long-Term Security Practices

Regularly update software and applications to patch known vulnerabilities.
Educate users on recognizing and avoiding suspicious files or links.

Patching and Updates

Adobe has released security updates to address CVE-2017-2960. Users should promptly apply these patches to mitigate the risk of exploitation.