Security Vulnerabilities fixed in ArcGIS ArcReader 10.8.2

Description

An out-of-bounds read and write, also use after free vulnerabilities exists when parsing a specially crafted file in Esri ArcReader 10.8.1 (and earlier) which allow an unauthenticated attacker to induce an information disclosure issue in the context of the current user.

Affected Applications

ArcGIS ArcReader

CVE References

CVE-2021-29112 CVE-2021-29117 CVE-2021-29118

Other References

https://www.esri.com/arcgis-blog/products/arcgis-desktop/administration/arcreader-general-data-frame-security-update/