« Volver al listado

CVE-2018-4915

Estado: ModificadaAlta (8.8)—

Se ha descubierto un problema en Adobe Acrobat Reader 2018.009.20050 y anteriores, 2017.011.30070 y anteriores y 2015.006.30394 y anteriores. La vulnerabilidad se debe a un cálculo que escribe datos más allá del final del búfer planeado; el cálculo forma parte de la API JavaScript relacionada con la conversión de color. Un atacante podría aprovechar la vulnerabilidad para corromper datos sensibles o ejecutar código arbitrario.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Adobe — AcrobatAdobe — Acrobat DCAdobe — Acrobat ReaderAdobe — Acrobat Reader DC

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-4915",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions",
          "versions": [
            {
              "status": "affected",
              "version": "Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-27T05:29:02.313",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/102994",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1040364",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb18-02.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-18-212/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "http://www.securityfocus.com/bid/102994",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1040364",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://helpx.adobe.com/security/products/acrobat/apsb18-02.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Adobe Acrobat Reader 2018.009.20050 and earlier versions, 2017.011.30070 and earlier versions, 2015.006.30394 and earlier versions. The vulnerability is caused by the computation that writes data past the end of the intended buffer; the computation is part of the JavaScript API related to color conversion. An attacker can potentially leverage the vulnerability to corrupt sensitive data or execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en Adobe Acrobat Reader 2018.009.20050 y anteriores, 2017.011.30070 y anteriores y 2015.006.30394 y anteriores. La vulnerabilidad se debe a un cálculo que escribe datos más allá del final del búfer planeado; el cálculo forma parte de la API JavaScript relacionada con la conversión de color. Un atacante podría aprovechar la vulnerabilidad para corromper datos sensibles o ejecutar código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T01:59:16.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AA5E332-A7C9-40EE-AA1D-ECD20C6AC948",
              "versionEndIncluding": "17.011.30070",
              "versionStartIncluding": "17.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:continuous:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5561E635-D92E-4598-9D10-2FB1F7B3AD82",
              "versionEndIncluding": "18.009.20050",
              "versionStartIncluding": "-"
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_dc:*:*:*:*:classic:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "665540E1-CF26-4390-BC76-5FEF40E7DB9F",
              "versionEndIncluding": "15.006.30394",
              "versionStartIncluding": "15.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E402EC4-3717-4634-90E9-BDE1C76FAB5E",
              "versionEndIncluding": "17.011.30070",
              "versionStartIncluding": "17.0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:continuous:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "381AB5FE-10AE-4B06-9CAD-0614295928BA",
              "versionEndIncluding": "18.009.20050",
              "versionStartIncluding": "-"
            },
            {
              "criteria": "cpe:2.3:a:adobe:acrobat_reader_dc:*:*:*:*:classic:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68EEAB61-2409-432D-B10F-0B59FC4EB1E1",
              "versionEndIncluding": "15.006.30394",
              "versionStartIncluding": "15.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}