Details of VAR-201510-0351

ID

VAR-201510-0351

CVE

CVE-2015-6702

TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat of createSquareMesh Vulnerability in function that can retrieve important information from process memory

Trust: 0.8

sources: JVNDB: JVNDB-2015-005259

DESCRIPTION

The createSquareMesh function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6703, and CVE-2015-6704. This vulnerability CVE-2015-6697 , CVE-2015-6699 , CVE-2015-6700 , CVE-2015-6701 , CVE-2015-6703 ,and CVE-2015-6704 Is a different vulnerability.An attacker could retrieve important information from process memory via an invalid argument. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of the createSquareMesh function. The issue lies in excess values being returned in the error message when improper arguments are given. Adobe Acrobat and Reader are prone to multiple information-disclosure vulnerabilities. An attacker can exploit these issues to gain access to sensitive information that may aid in further attacks. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. A security vulnerability exists in the 'createSquareMesh' function of several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

Trust: 2.7

sources: NVD: CVE-2015-6702 // JVNDB: JVNDB-2015-005259 // ZDI: ZDI-15-480 // BID: 77067 // VULHUB: VHN-84663 // VULMON: CVE-2015-6702

AFFECTED PRODUCTS

vendor:	adobe	model:	acrobat dc	scope:	gte	version:	15.006.30060	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	gte	version:	15.008.20082	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	lte	version:	10.1.15	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	gte	version:	10.0	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	lte	version:	10.1.15	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	gte	version:	10.0	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	15.006.30094	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	15.009.20069	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	gte	version:	15.006.30060	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	15.009.20069	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	gte	version:	15.008.20082	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	lte	version:	11.0.12	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	lte	version:	11.0.12	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	15.006.30094	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	gte	version:	11.0.0	Trust: 1.0
vendor:	adobe	model:	acrobat reader	scope:	gte	version:	11.0.0	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.14	Trust: 0.9
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.12	Trust: 0.9
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.3	Trust: 0.9
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.4	Trust: 0.9
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.11	Trust: 0.9
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	(windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	(windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	classic 2015.006.30094	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	lt	version:	11.x (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	eq	version:	xi desktop 11.0.13	Trust: 0.8
vendor:	adobe	model:	reader	scope:	lt	version:	11.x (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	continuous 2015.009.20069	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	lt	version:	10.x (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	eq	version:	xi desktop 11.0.13	Trust: 0.8
vendor:	adobe	model:	acrobat	scope:	eq	version:	x desktop 10.1.16	Trust: 0.8
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	classic 2015.006.30094	Trust: 0.8
vendor:	adobe	model:	reader	scope:	lt	version:	10.x (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	continuous 2015.009.20069	Trust: 0.8
vendor:	adobe	model:	reader	scope:	eq	version:	x desktop 10.1.16	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	-	version:	-	Trust: 0.7
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.4	Trust: 0.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.2	Trust: 0.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.7	Trust: 0.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	10.1.3	Trust: 0.6
vendor:	adobe	model:	acrobat reader	scope:	eq	version:	11.0.3	Trust: 0.6
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.9	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.13	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	2015.8.20082	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.10	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.2	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	ne	version:	2015.006.30094	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.15	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	2015.6.30060	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.3	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.10	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.13	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.6	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	ne	version:	11.0.13	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	ne	version:	2015.006.30094	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.10	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.4	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.3	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	ne	version:	10.1.16	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.2	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.11	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.4	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.6	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.11	Trust: 0.3
vendor:	adobe	model:	reader	scope:	ne	version:	11.0.13	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.7	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.14	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.3	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.1	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	ne	version:	10.1.16	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0.2	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.5	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	2015.007.20033	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.12	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.2	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.13	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.4	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.8	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.11	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.2	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.08	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.9	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.7	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.6	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	2015.006.30060	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.05	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.10	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.09	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	ne	version:	2015.009.20069	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	2015.006.30033	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	10.1.12	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.1	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.9	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	ne	version:	2015.009.20069	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	2015.006.30033	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.12	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.08	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	2015.008.20082	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.7	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.0.1	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	2015.007.20033	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.09	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	10.1.15	Trust: 0.3

sources: ZDI: ZDI-15-480 // BID: 77067 // JVNDB: JVNDB-2015-005259 // CNNVD: CNNVD-201510-215 // NVD: CVE-2015-6702

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-6702
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2015-6702
value:	MEDIUM
Trust: 0.8
ZDI:	CVE-2015-6702
value:	MEDIUM
Trust: 0.7
CNNVD:	CNNVD-201510-215
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-84663
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2015-6702
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2015-6702
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
ZDI:	CVE-2015-6702
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.7
VULHUB:	VHN-84663
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: ZDI: ZDI-15-480 // VULHUB: VHN-84663 // VULMON: CVE-2015-6702 // JVNDB: JVNDB-2015-005259 // CNNVD: CNNVD-201510-215 // NVD: CVE-2015-6702

PROBLEMTYPE DATA

problemtype:	CWE-772	Trust: 1.1
problemtype:	CWE-200	Trust: 0.9

sources: VULHUB: VHN-84663 // JVNDB: JVNDB-2015-005259 // NVD: CVE-2015-6702

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-215

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201510-215

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-005259

PATCH

title:	APSB15-24	url:	https://helpx.adobe.com/security/products/acrobat/apsb15-24.html	Trust: 1.5
title:	APSB15-24	url:	https://helpx.adobe.com/jp/security/products/reader/apsb15-24.html	Trust: 0.8
title:	アドビシステムズ社 Adobe Reader の脆弱性に関するお知らせ	url:	http://www.fmworld.net/biz/common/adobe/20151015.html	Trust: 0.8
title:	Multiple Adobe Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58064	Trust: 0.6

sources: ZDI: ZDI-15-480 // JVNDB: JVNDB-2015-005259 // CNNVD: CNNVD-201510-215

EXTERNAL IDS

db:	NVD	id:	CVE-2015-6702	Trust: 3.6
db:	ZDI	id:	ZDI-15-480	Trust: 2.8
db:	SECTRACK	id:	1033796	Trust: 1.8
db:	JVNDB	id:	JVNDB-2015-005259	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-3049	Trust: 0.7
db:	CNNVD	id:	CNNVD-201510-215	Trust: 0.7
db:	BID	id:	77067	Trust: 0.4
db:	ZDI	id:	ZDI-15-481	Trust: 0.3
db:	ZDI	id:	ZDI-15-475	Trust: 0.3
db:	ZDI	id:	ZDI-15-482	Trust: 0.3
db:	ZDI	id:	ZDI-15-479	Trust: 0.3
db:	ZDI	id:	ZDI-15-478	Trust: 0.3
db:	ZDI	id:	ZDI-15-477	Trust: 0.3
db:	VULHUB	id:	VHN-84663	Trust: 0.1
db:	VULMON	id:	CVE-2015-6702	Trust: 0.1

sources: ZDI: ZDI-15-480 // VULHUB: VHN-84663 // VULMON: CVE-2015-6702 // BID: 77067 // JVNDB: JVNDB-2015-005259 // CNNVD: CNNVD-201510-215 // NVD: CVE-2015-6702

REFERENCES

url:	https://helpx.adobe.com/security/products/acrobat/apsb15-24.html	Trust: 2.8
url:	http://www.zerodayinitiative.com/advisories/zdi-15-480	Trust: 1.8
url:	http://www.securitytracker.com/id/1033796	Trust: 1.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6702	Trust: 0.8
url:	http://www.ipa.go.jp/security/ciadr/vul/20151014-adobereader.html	Trust: 0.8
url:	http://www.jpcert.or.jp/at/2015/at150035.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6702	Trust: 0.8
url:	http://www.npa.go.jp/cyberpolice/topics/?seq=17022	Trust: 0.8
url:	http://www.adobe.com	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-475/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-477/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-479/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-482/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-480/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-481/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-15-478/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/772.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.securityfocus.com/bid/77067	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=41495	Trust: 0.1

sources: ZDI: ZDI-15-480 // VULHUB: VHN-84663 // VULMON: CVE-2015-6702 // BID: 77067 // JVNDB: JVNDB-2015-005259 // CNNVD: CNNVD-201510-215 // NVD: CVE-2015-6702

CREDITS

AbdulAziz Hariri and Jasiel Spelman of HP Zero Day Initiative

Trust: 1.0

sources: ZDI: ZDI-15-480 // BID: 77067

SOURCES

db:	ZDI	id:	ZDI-15-480
db:	VULHUB	id:	VHN-84663
db:	VULMON	id:	CVE-2015-6702
db:	BID	id:	77067
db:	JVNDB	id:	JVNDB-2015-005259
db:	CNNVD	id:	CNNVD-201510-215
db:	NVD	id:	CVE-2015-6702

LAST UPDATE DATE

2024-11-23T21:43:45.981000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-15-480	date:	2015-10-13T00:00:00
db:	VULHUB	id:	VHN-84663	date:	2020-05-18T00:00:00
db:	VULMON	id:	CVE-2015-6702	date:	2021-09-08T00:00:00
db:	BID	id:	77067	date:	2015-11-03T19:59:00
db:	JVNDB	id:	JVNDB-2015-005259	date:	2015-10-16T00:00:00
db:	CNNVD	id:	CNNVD-201510-215	date:	2020-05-19T00:00:00
db:	NVD	id:	CVE-2015-6702	date:	2024-11-21T02:35:28.460

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-15-480	date:	2015-10-13T00:00:00
db:	VULHUB	id:	VHN-84663	date:	2015-10-14T00:00:00
db:	VULMON	id:	CVE-2015-6702	date:	2015-10-14T00:00:00
db:	BID	id:	77067	date:	2015-10-13T00:00:00
db:	JVNDB	id:	JVNDB-2015-005259	date:	2015-10-16T00:00:00
db:	CNNVD	id:	CNNVD-201510-215	date:	2015-10-15T00:00:00
db:	NVD	id:	CVE-2015-6702	date:	2015-10-14T23:59:24.740