Details of VAR-201505-0304

ID

VAR-201505-0304

CVE

CVE-2015-3052

TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-002630

DESCRIPTION

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3050, CVE-2015-3051, CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076. Adobe Reader and Acrobat are prone to multiple memory-corruption vulnerabilities. Failed exploit attempts will likely result in denial-of-service conditions. Adobe Reader is a free PDF file reader, and Acrobat is a PDF file editing and conversion tool. The following products and versions are affected: Adobe Reader 10.1.13 and earlier and 11.0.10 and earlier, Acrobat 10.1.13 and earlier and 11.0.10 and earlier

Trust: 1.98

sources: NVD: CVE-2015-3052 // JVNDB: JVNDB-2015-002630 // BID: 74600 // VULHUB: VHN-81013

AFFECTED PRODUCTS

vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.1	Trust: 1.9
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.8	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.6	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.5	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.7	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.10	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.4	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.11	Trust: 1.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.9	Trust: 1.6
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.0	Trust: 1.6
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.3	Trust: 1.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.2	Trust: 1.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.5	Trust: 1.0
vendor:	apple	model:	mac os x	scope:	eq	version:	*	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.4	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.4	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.9	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.0	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.3	Trust: 1.0
vendor:	microsoft	model:	windows	scope:	eq	version:	*	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.7	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.0	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.11	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.8	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.9	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.1	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.7	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.6	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.5	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.6	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.12	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.10	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.8	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.2	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.13	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.2	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.4	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.3	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.9	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.1	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.3	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.7	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.6	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.12	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.0	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.8	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.5	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.10	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.1	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.10	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.13	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.2	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	xi (11.0.11)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	lt	version:	11.x (windows macintosh)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	lt	version:	10.x (windows macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	eq	version:	x (10.1.14)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	eq	version:	xi (11.0.11)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	eq	version:	x (10.1.14)	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	lt	version:	11.x (windows macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	lt	version:	10.x (windows macintosh)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.3	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.2	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0.3	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0.2	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.2	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0	Trust: 0.3

sources: BID: 74600 // JVNDB: JVNDB-2015-002630 // CNNVD: CNNVD-201505-165 // NVD: CVE-2015-3052

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-3052
value:	HIGH
Trust: 1.0
NVD:	CVE-2015-3052
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201505-165
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-81013
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-3052
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-81013
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-81013 // JVNDB: JVNDB-2015-002630 // CNNVD: CNNVD-201505-165 // NVD: CVE-2015-3052

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-81013 // JVNDB: JVNDB-2015-002630 // NVD: CVE-2015-3052

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201505-165

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201505-165

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-002630

PATCH

title:	APSB15-10	url:	http://helpx.adobe.com/security/products/reader/apsb15-10.html	Trust: 0.8
title:	APSB15-10	url:	http://helpx.adobe.com/jp/security/products/reader/apsb15-10.html	Trust: 0.8
title:	アドビシステムズ社 Adobe Reader の脆弱性に関するお知らせ	url:	http://www.fmworld.net/biz/common/adobe/20150514.html	Trust: 0.8

sources: JVNDB: JVNDB-2015-002630

EXTERNAL IDS

db:	NVD	id:	CVE-2015-3052	Trust: 2.8
db:	BID	id:	74600	Trust: 1.4
db:	SECTRACK	id:	1032284	Trust: 1.1
db:	JVNDB	id:	JVNDB-2015-002630	Trust: 0.8
db:	CNNVD	id:	CNNVD-201505-165	Trust: 0.7
db:	PACKETSTORM	id:	137340	Trust: 0.1
db:	VULHUB	id:	VHN-81013	Trust: 0.1

sources: VULHUB: VHN-81013 // BID: 74600 // JVNDB: JVNDB-2015-002630 // CNNVD: CNNVD-201505-165 // NVD: CVE-2015-3052

REFERENCES

url:	https://helpx.adobe.com/security/products/reader/apsb15-10.html	Trust: 1.7
url:	http://www.securityfocus.com/bid/74600	Trust: 1.1
url:	http://www.securitytracker.com/id/1032284	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3052	Trust: 0.8
url:	http://www.ipa.go.jp/security/ciadr/vul/20150513-adobereader.html	Trust: 0.8
url:	http://www.jpcert.or.jp/at/2015/at150014.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3052	Trust: 0.8
url:	http://www.npa.go.jp/cyberpolice/topics?seq=16279	Trust: 0.8
url:	http://www.adobe.com	Trust: 0.3
url:	http://get.adobe.com/reader/	Trust: 0.3

sources: VULHUB: VHN-81013 // BID: 74600 // JVNDB: JVNDB-2015-002630 // CNNVD: CNNVD-201505-165 // NVD: CVE-2015-3052

CREDITS

instruder of Alibaba Security Research Team, Mateusz Jurczyk of Google Project Zero, Alex Inführ of Cure53.de, Mateusz Jurczyk of Google Project Zero and Gynvael Coldwind of Google Security Team, Wei Lei, as well as Wu Hongjun of Nanyang Technological Uni

Trust: 0.3

sources: BID: 74600

SOURCES

db:	VULHUB	id:	VHN-81013
db:	BID	id:	74600
db:	JVNDB	id:	JVNDB-2015-002630
db:	CNNVD	id:	CNNVD-201505-165
db:	NVD	id:	CVE-2015-3052

LAST UPDATE DATE

2024-11-23T21:44:17.434000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-81013	date:	2017-01-03T00:00:00
db:	BID	id:	74600	date:	2015-07-15T01:02:00
db:	JVNDB	id:	JVNDB-2015-002630	date:	2015-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201505-165	date:	2015-05-15T00:00:00
db:	NVD	id:	CVE-2015-3052	date:	2024-11-21T02:28:33.803

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-81013	date:	2015-05-13T00:00:00
db:	BID	id:	74600	date:	2015-05-12T00:00:00
db:	JVNDB	id:	JVNDB-2015-002630	date:	2015-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201505-165	date:	2015-05-14T00:00:00
db:	NVD	id:	CVE-2015-3052	date:	2015-05-13T10:59:48.527