Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functions in the installer plugin. A successful exploitation could lead to arbitrary code execution.

The version of Adobe Digital Editions installed on the remote Windows host is prior to 4.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB17-20 advisory.

  - Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The     vulnerability is due to unsafe library loading functions in the installer plugin. A successful     exploitation could lead to arbitrary code execution. (CVE-2017-3097)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the PDF runtime engine. Successful exploitation could lead to arbitrary code execution. (CVE-2017-3088)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the PDF imaging model. Successful exploitation could lead to arbitrary code execution. (CVE-2017-3089)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the bitmap representation module. Successful exploitation could lead to arbitrary code execution.
    (CVE-2017-3093)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the character code mapping module. Successful exploitation could lead to arbitrary code execution.
    (CVE-2017-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Digital Editions installed on the remote macOS host is prior to 4.5.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB17-20 advisory.

  - Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The     vulnerability is due to unsafe library loading functions in the installer plugin. A successful     exploitation could lead to arbitrary code execution. (CVE-2017-3097)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the PDF runtime engine. Successful exploitation could lead to arbitrary code execution. (CVE-2017-3088)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the PDF imaging model. Successful exploitation could lead to arbitrary code execution. (CVE-2017-3089)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the bitmap representation module. Successful exploitation could lead to arbitrary code execution.
    (CVE-2017-3093)

  - Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in     the character code mapping module. Successful exploitation could lead to arbitrary code execution.
    (CVE-2017-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Digital Editions installed on the remote macOS or Mac OS X host is prior to 4.5.5. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit these to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-3088, CVE-2017-3089, CVE-2017-3093,     CVE-2017-3096)

  - Multiple unspecified flaws exist related to insecure     loading of libraries. A local attacker can exploit these     to gain elevated privileges. (CVE-2017-3090,     CVE-2017-3092, CVE-2017-3097)

  - Multiple stack-based buffer overflow conditions exist     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     disclose memory contents. (CVE-2017-3094, CVE-2017-3095)

The version of Adobe Digital Editions installed on the remote Windows host is prior to 4.5.5. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit these to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2017-3088, CVE-2017-3089, CVE-2017-3093,     CVE-2017-3096)

  - Multiple unspecified flaws exist related to insecure     loading of libraries. A local attacker can exploit these     to gain elevated privileges. (CVE-2017-3090,     CVE-2017-3092, CVE-2017-3097)

  - Multiple stack-based buffer overflow conditions exist     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     disclose memory contents. (CVE-2017-3094, CVE-2017-3095)

ID	Name	Product	Family	Severity
209382	Adobe Digital Editions < 4.5.5 Multiple Vulnerabilities (APSB17-20)	Nessus	Windows	critical
209381	Adobe Digital Editions < 4.5.5 Multiple Vulnerabilities (APSB17-20) (macOS)	Nessus	MacOS X Local Security Checks	critical
100793	Adobe Digital Editions < 4.5.5 Multiple Vulnerabilities (APSB17-20) (macOS)	Nessus	MacOS X Local Security Checks	critical
100792	Adobe Digital Editions < 4.5.5 Multiple Vulnerabilities (APSB17-20)	Nessus	Windows	critical

Detections

Analytics

CVE-2017-3097

critical

Tenable Plugins

critical

critical

critical

critical