Sign-up

ID

VAR-201510-0046


CVE

CVE-2015-7621


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-005299

DESCRIPTION

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617. This vulnerability CVE-2015-5586 , CVE-2015-6683 , CVE-2015-6684 , CVE-2015-6687 , CVE-2015-6688 , CVE-2015-6689 , CVE-2015-6690 , CVE-2015-6691 , CVE-2015-7615 ,and CVE-2015-7617 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlCrafted by attackers U3D Arbitrary code may be executed through the object. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of U3D objects. A specially crafted U3D object can force a dangling pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process. Adobe Acrobat and Reader are prone to multiple remote code-execution vulnerabilities. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. A use-after-free vulnerability exists in several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

Trust: 2.7

sources: NVD: CVE-2015-7621 // JVNDB: JVNDB-2015-005299 // ZDI: ZDI-15-508 // BID: 77064 // VULHUB: VHN-85582 // VULMON: CVE-2015-7621

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope: - version: -

Trust: 0.7

vendor:adobemodel:acrobat readerscope:eqversion:11.0.5

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.8

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.6

vendor:adobemodel:acrobat reader dcscope:eqversion:2015.006.30060

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.6

vendor:adobemodel:acrobat reader dcscope:eqversion:2015.008.20082

Trust: 0.6

vendor:adobemodel:acrobat dcscope:eqversion:2015.006.30060

Trust: 0.6

vendor:adobemodel:acrobat dcscope:eqversion:2015.008.20082

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.6

vendor:adobemodel:readerscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0

Trust: 0.3

sources: ZDI: ZDI-15-508 // BID: 77064 // JVNDB: JVNDB-2015-005299 // CNNVD: CNNVD-201510-246 // NVD: CVE-2015-7621

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7621
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-7621
value: HIGH

Trust: 0.8

ZDI: CVE-2015-7621
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201510-246
value: CRITICAL

Trust: 0.6

VULHUB: VHN-85582
value: MEDIUM

Trust: 0.1

VULMON: CVE-2015-7621
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-7621
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2015-7621
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-85582
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-15-508 // VULHUB: VHN-85582 // VULMON: CVE-2015-7621 // JVNDB: JVNDB-2015-005299 // CNNVD: CNNVD-201510-246 // NVD: CVE-2015-7621

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-85582 // JVNDB: JVNDB-2015-005299 // NVD: CVE-2015-7621

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-246

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201510-246

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005299

PATCH
title:APSB15-24url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 1.5
title:APSB15-24url:https://helpx.adobe.com/jp/security/products/reader/apsb15-24.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20151015.html
Trust: 0.8
title:Multiple Adobe Remediation measures for reusing vulnerabilities after product releaseurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58095
Trust: 0.6
sources:
            
            
            ZDI: ZDI-15-508 // 
            
            
            
            JVNDB: JVNDB-2015-005299 // 
            
            
            
            CNNVD: CNNVD-201510-246

EXTERNAL IDS
db:NVDid:CVE-2015-7621
Trust: 3.6
db:ZDIid:ZDI-15-508
Trust: 2.8
db:SECTRACKid:1033796
Trust: 1.8
db:JVNDBid:JVNDB-2015-005299
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-3101
Trust: 0.7
db:CNNVDid:CNNVD-201510-246
Trust: 0.7
db:BIDid:77064
Trust: 0.4
db:ZDIid:ZDI-15-470
Trust: 0.3
db:ZDIid:ZDI-15-493
Trust: 0.3
db:ZDIid:ZDI-15-469
Trust: 0.3
db:ZDIid:ZDI-15-474
Trust: 0.3
db:ZDIid:ZDI-15-492
Trust: 0.3
db:VULHUBid:VHN-85582
Trust: 0.1
db:VULMONid:CVE-2015-7621
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-508 // 
            
            
            
            VULHUB: VHN-85582 // 
            
            
            
            VULMON: CVE-2015-7621 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005299 // 
            
            
            
            CNNVD: CNNVD-201510-246 // 
            
            
            
            NVD: CVE-2015-7621

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 2.8
url:http://www.zerodayinitiative.com/advisories/zdi-15-508
Trust: 1.8
url:http://www.securitytracker.com/id/1033796
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7621
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20151014-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2015/at150035.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7621
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=17022
Trust: 0.8
url:http://www.adobe.com
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-469/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-470/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-474/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-492/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-493/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-508/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/416.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.securityfocus.com/bid/77064
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=41495
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-508 // 
            
            
            
            VULHUB: VHN-85582 // 
            
            
            
            VULMON: CVE-2015-7621 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005299 // 
            
            
            
            CNNVD: CNNVD-201510-246 // 
            
            
            
            NVD: CVE-2015-7621

CREDITS
kdot
Trust: 0.7
sources:
            
            
            ZDI: ZDI-15-508

SOURCES
db:ZDIid:ZDI-15-508
db:VULHUBid:VHN-85582
db:VULMONid:CVE-2015-7621
db:BIDid:77064
db:JVNDBid:JVNDB-2015-005299
db:CNNVDid:CNNVD-201510-246
db:NVDid:CVE-2015-7621

LAST UPDATE DATE
2024-11-23T21:43:45.228000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-508date:2015-10-13T00:00:00
db:VULHUBid:VHN-85582date:2020-05-19T00:00:00
db:VULMONid:CVE-2015-7621date:2021-09-08T00:00:00
db:BIDid:77064date:2015-10-26T17:00:00
db:JVNDBid:JVNDB-2015-005299date:2015-10-19T00:00:00
db:CNNVDid:CNNVD-201510-246date:2020-05-20T00:00:00
db:NVDid:CVE-2015-7621date:2024-11-21T02:37:04.670

SOURCES RELEASE DATE
db:ZDIid:ZDI-15-508date:2015-10-13T00:00:00
db:VULHUBid:VHN-85582date:2015-10-14T00:00:00
db:VULMONid:CVE-2015-7621date:2015-10-14T00:00:00
db:BIDid:77064date:2015-10-13T00:00:00
db:JVNDBid:JVNDB-2015-005299date:2015-10-19T00:00:00
db:CNNVDid:CNNVD-201510-246date:2015-10-15T00:00:00
db:NVDid:CVE-2015-7621date:2015-10-14T23:59:54.823