Security Advisory - February 11, 2020
Zscaler protects against 11 new vulnerabilities for Adobe Acrobat and Reader.
Zscaler, working with Microsoft through their MAPP program, has proactively deployed protections for the following 11 vulnerabilities included in the February 2020 Adobe security bulletins. Zscaler will continue to monitor exploits associated with all vulnerabilities in the February release and deploy additional protections as necessary.
APSB20-05 – Security updates available for Adobe Acrobat and Reader.
Adobe has released security updates for Adobe Acrobat and Reader for Windows and macOS. These updates address critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user.
Affected Software
- Acrobat DC (Continuous) 2019.021.20061 and earlier versions for Windows & macOS
- Acrobat Reader DC (Continuous) 2019.021.20061 and earlier versions for Windows & macOS
- Acrobat 2017 (Classic 2017) 2017.011.30156 and earlier versions for Windows & macOS
- Acrobat Reader 2017 (Classic 2017) 2017.011.30156 and earlier versions for Windows & macOS
- Acrobat 2015 (Classic 2015) 2015.006.30508 and earlier versions for Windows & macOS
- Acrobat Reader 2015 (Classic 2015) 2015.006.30508 and earlier versions for Windows & macOS
CVE-2020-3741 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3743 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3744 – Out-of-Bounds Read leading to Information Disclosure.
Severity: Important
CVE-2020-3745 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3746 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3747 – Out of Bounds Read Vulnerability leading to Information Disclosure.
Severity: Important
CVE-2020-3748 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3750 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3751 – Use After Free Vulnerability leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3752 – Buffer Error leading to Arbitrary Code Execution.
Severity: Critical
CVE-2020-3755 – Out-of-Bounds Read leading to Information Disclosure.
Severity: Important