Sign-up

ID

VAR-201510-0343


CVE

CVE-2015-6683


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-005240

DESCRIPTION

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621. This vulnerability CVE-2015-5586 , CVE-2015-6684 , CVE-2015-6687 , CVE-2015-6688 , CVE-2015-6689 , CVE-2015-6690 , CVE-2015-6691 , CVE-2015-7615 , CVE-2015-7617 ,and CVE-2015-7621 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Adobe Acrobat and Reader are prone to multiple remote code-execution vulnerabilities. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. A use-after-free vulnerability exists in several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

Trust: 1.98

sources: NVD: CVE-2015-6683 // JVNDB: JVNDB-2015-005240 // BID: 77064 // VULHUB: VHN-84644

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.8

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.5

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.6

vendor:adobemodel:readerscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0

Trust: 0.3

sources: BID: 77064 // JVNDB: JVNDB-2015-005240 // CNNVD: CNNVD-201510-196 // NVD: CVE-2015-6683

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6683
value: HIGH

Trust: 1.0

NVD: CVE-2015-6683
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201510-196
value: CRITICAL

Trust: 0.6

VULHUB: VHN-84644
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-6683
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-84644
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-84644 // JVNDB: JVNDB-2015-005240 // CNNVD: CNNVD-201510-196 // NVD: CVE-2015-6683

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-84644 // JVNDB: JVNDB-2015-005240 // NVD: CVE-2015-6683

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-196

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201510-196

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005240

PATCH
title:APSB15-24url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 0.8
title:APSB15-24url:https://helpx.adobe.com/jp/security/products/reader/apsb15-24.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20151015.html
Trust: 0.8
title:Multiple Adobe Remediation measures for reusing vulnerabilities after product releaseurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58045
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-005240 // 
            
            
            
            CNNVD: CNNVD-201510-196

EXTERNAL IDS
db:NVDid:CVE-2015-6683
Trust: 2.8
db:SECTRACKid:1033796
Trust: 1.7
db:JVNDBid:JVNDB-2015-005240
Trust: 0.8
db:CNNVDid:CNNVD-201510-196
Trust: 0.7
db:ZDIid:ZDI-15-508
Trust: 0.3
db:ZDIid:ZDI-15-470
Trust: 0.3
db:ZDIid:ZDI-15-493
Trust: 0.3
db:ZDIid:ZDI-15-469
Trust: 0.3
db:ZDIid:ZDI-15-474
Trust: 0.3
db:ZDIid:ZDI-15-492
Trust: 0.3
db:BIDid:77064
Trust: 0.3
db:VULHUBid:VHN-84644
Trust: 0.1
sources:
            
            
            VULHUB: VHN-84644 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005240 // 
            
            
            
            CNNVD: CNNVD-201510-196 // 
            
            
            
            NVD: CVE-2015-6683

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 2.0
url:https://www.verisign.com/en_us/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1206
Trust: 1.7
url:http://www.securitytracker.com/id/1033796
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6683
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20151014-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2015/at150035.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6683
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=17022
Trust: 0.8
url:http://www.adobe.com
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-469/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-470/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-474/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-492/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-493/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-508/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-84644 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005240 // 
            
            
            
            CNNVD: CNNVD-201510-196 // 
            
            
            
            NVD: CVE-2015-6683

CREDITS
AbdulAziz Hariri of HP Zero Day Initiative, Bill Finlayson of Vectra Networks, bilou working with VeriSign iDefense Labs, James Loureiro of MWR Labs, kdot working with HP's's Zero Day Initiative, Wei Lei and Wu Hongjun of Nanyang Technological University w
Trust: 0.3
sources:
            
            
            BID: 77064

SOURCES
db:VULHUBid:VHN-84644
db:BIDid:77064
db:JVNDBid:JVNDB-2015-005240
db:CNNVDid:CNNVD-201510-196
db:NVDid:CVE-2015-6683

LAST UPDATE DATE
2024-11-23T21:43:44.787000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-84644date:2020-05-18T00:00:00
db:BIDid:77064date:2015-10-26T17:00:00
db:JVNDBid:JVNDB-2015-005240date:2015-10-16T00:00:00
db:CNNVDid:CNNVD-201510-196date:2020-05-19T00:00:00
db:NVDid:CVE-2015-6683date:2024-11-21T02:35:26.133

SOURCES RELEASE DATE
db:VULHUBid:VHN-84644date:2015-10-14T00:00:00
db:BIDid:77064date:2015-10-13T00:00:00
db:JVNDBid:JVNDB-2015-005240date:2015-10-16T00:00:00
db:CNNVDid:CNNVD-201510-196date:2015-10-15T00:00:00
db:NVDid:CVE-2015-6683date:2015-10-14T23:59:04.467