Jaanus

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) Microsoft Excel Viewer (affected versions not specified) Microsoft Office (affected versions not specified) **Description** An information disclosure issue exists due to Microsoft Excel's improper handling of memory contents. This could allow a remote attacker to access protected information, including data previously deleted from the active worksheet. **Recommendations** For Microsoft Excel, consider implementing memory protection measures to prevent information disclosure until a patch is available. For Microsoft Excel Viewer, restrict access to sensitive information when using the viewer until a fix is provided. For Microsoft Office, as a temporary workaround, avoid using Microsoft Excel for handling sensitive data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader versions prior to 11.0.17 Adobe Reader Document Cloud versions prior to 15.006.30198 Adobe Acrobat versions prior to 11.0.17 Adobe Acrobat Document Cloud Classic versions prior to 15.006.30198 Adobe Acrobat Document Cloud Continuous versions prior to 15.017.20050 **Description** The issue is related to a use-after-free vulnerability, which can be exploited by a remote attacker to execute arbitrary code. This vulnerability is associated with the improper use of memory after it has been freed. **Recommendations** For Adobe Reader versions prior to 11.0.17, update to version 11.0.17 or later. For Adobe Reader Document Cloud versions prior to 15.006.30198, update to version 15.006.30198 or later. For Adobe Acrobat versions prior to 11.0.17, update to version 11.0.17 or later. For Adobe Acrobat Document Cloud Classic versions prior to 15.006.30198, update to version 15.006.30198 or later. For Adobe Acrobat Document Cloud Continuous versions prior to 15.017.20050, update to version 15.017.20050 or later.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader versions (affected versions not specified) Adobe Acrobat versions (affected versions not specified) **Description** The issue is caused by a buffer overflow in Adobe Reader and Adobe Acrobat, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption). A memory corruption vulnerability in these programs enables attackers to execute code. **Recommendations** For Adobe Reader, update to a version that fixes the buffer overflow issue. For Adobe Acrobat, update to a version that fixes the buffer overflow issue. As a temporary workaround, consider restricting access to PDF files until a patch is available. Avoid using the `FlateDecode` parsing function in Adobe Reader DC until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader versions prior to 7.3.4 PhantomPDF versions prior to 7.3.4 **Description** The issue is related to a use-after-free vulnerability that can be exploited by remote attackers to execute arbitrary code. This is achieved through a crafted FlateDecode stream in a PDF document. **Recommendations** For Foxit Reader versions prior to 7.3.4, update to version 7.3.4 or later. For PhantomPDF versions prior to 7.3.4, update to version 7.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Windows Reader versions in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 **Description** The issue is related to insufficient data validation in the Windows Reader component, allowing remote attackers to execute arbitrary code via a crafted Reader file. This could enable an attacker to take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights, especially if the user is logged on with administrative user rights. Users with fewer user rights on the system may be less impacted. **Recommendations** For Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10, consider disabling the Windows Reader component until a patch is available to prevent exploitation. Restrict access to specially crafted Reader files to minimize the risk of arbitrary code execution. Avoid opening untrusted or specially crafted files in Windows Reader until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader (affected versions not specified) Adobe Acrobat (affected versions not specified) **Description** The issue is caused by a buffer overflow in Adobe Reader and Acrobat, allowing a remote attacker to execute arbitrary code or cause a denial of service (memory corruption). A memory corruption vulnerability in these products enables attackers to execute code. The vulnerability is also related to out-of-bounds indexing in the JPEG2000 component. **Recommendations** For Adobe Reader, update to a version that fixes the buffer overflow issue. For Adobe Acrobat, update to a version that fixes the buffer overflow issue. As a temporary workaround, consider disabling the JPEG2000 component in Adobe Reader and Acrobat until a patch is available. Restrict access to untrusted PDF files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader version not specified Adobe Acrobat version not specified **Description** The issue is caused by a buffer overflow in the AcroForm plugin of Adobe Reader and Acrobat. This allows a remote attacker to execute arbitrary code or cause a denial of service (memory corruption). **Recommendations** For Adobe Reader, update to a version that fixes the buffer overflow issue in the AcroForm plugin. For Adobe Acrobat, update to a version that fixes the buffer overflow issue in the AcroForm plugin. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader version not specified Adobe Acrobat version not specified Adobe Reader Document Cloud version not specified Adobe Acrobat Document Cloud version not specified **Description** The issue is caused by a buffer overflow in Adobe PDF viewer and editor applications. This allows a remote attacker to execute arbitrary code or cause a denial of service, such as dereferencing an uninitialized pointer or memory corruption. **Recommendations** For Adobe Reader, update to a version that contains a fix for this issue. For Adobe Acrobat, update to a version that contains a fix for this issue. For Adobe Reader Document Cloud, update to a version that contains a fix for this issue. For Adobe Acrobat Document Cloud, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to PDF files from untrusted sources until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader and Acrobat versions 10.x through 10.1.15 Adobe Reader and Acrobat versions 11.x through 11.0.12 Acrobat and Acrobat Reader DC Classic versions prior to 2015.006.30094 Acrobat and Acrobat Reader DC Continuous versions prior to 2015.009.20069 **Description** The issue is caused by a heap-based buffer overflow in the dynamic memory, allowing attackers to execute arbitrary code via unspecified vectors. This can be exploited by a remote attacker to execute code. **Recommendations** For Adobe Reader and Acrobat versions 10.x, update to version 10.1.16 or later. For Adobe Reader and Acrobat versions 11.x, update to version 11.0.13 or later. For Acrobat and Acrobat Reader DC Classic, update to version 2015.006.30094 or later. For Acrobat and Acrobat Reader DC Continuous, update to version 2015.009.20069 or later.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader and Acrobat versions 10.x through 10.1.15 Adobe Reader and Acrobat versions 11.x through 11.0.12 Acrobat and Acrobat Reader DC Classic versions prior to 2015.006.30094 Acrobat and Acrobat Reader DC Continuous versions prior to 2015.009.20069 **Description** The issue is a heap-based buffer overflow in the AcroForm implementation, allowing attackers to execute arbitrary code via unspecified vectors. This can be exploited by a remote attacker to execute code. The vulnerability is related to the implementation of AcroForm in Adobe Acrobat and Adobe Reader, which is used for editing and viewing PDF files. **Recommendations** For Adobe Reader and Acrobat versions 10.x, update to version 10.1.16 or later. For Adobe Reader and Acrobat versions 11.x, update to version 11.0.13 or later. For Acrobat and Acrobat Reader DC Classic, update to version 2015.006.30094 or later. For Acrobat and Acrobat Reader DC Continuous, update to version 2015.009.20069 or later.