Sign-up

ID

VAR-201510-0358


CVE

CVE-2015-6687


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-005244

DESCRIPTION

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621. This vulnerability CVE-2015-5586 , CVE-2015-6683 , CVE-2015-6684 , CVE-2015-6688 , CVE-2015-6689 , CVE-2015-6690 , CVE-2015-6691 , CVE-2015-7615 , CVE-2015-7617 ,and CVE-2015-7621 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Adobe Acrobat and Reader are prone to multiple remote code-execution vulnerabilities. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. A use-after-free vulnerability exists in several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

Trust: 1.98

sources: NVD: CVE-2015-6687 // JVNDB: JVNDB-2015-005244 // BID: 77064 // VULHUB: VHN-84648

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:10.1.8

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.2

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.4

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.0

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.7

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.3

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.1

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.5

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:10.1.5

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.6

Trust: 0.6

vendor:adobemodel:readerscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0

Trust: 0.3

sources: BID: 77064 // JVNDB: JVNDB-2015-005244 // CNNVD: CNNVD-201510-200 // NVD: CVE-2015-6687

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6687
value: HIGH

Trust: 1.0

NVD: CVE-2015-6687
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201510-200
value: CRITICAL

Trust: 0.6

VULHUB: VHN-84648
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-6687
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-84648
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-84648 // JVNDB: JVNDB-2015-005244 // CNNVD: CNNVD-201510-200 // NVD: CVE-2015-6687

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-84648 // JVNDB: JVNDB-2015-005244 // NVD: CVE-2015-6687

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-200

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201510-200

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005244

PATCH
title:APSB15-24url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 0.8
title:APSB15-24url:https://helpx.adobe.com/jp/security/products/reader/apsb15-24.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20151015.html
Trust: 0.8
title:Multiple Adobe Remediation measures for reusing vulnerabilities after product releaseurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58049
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-005244 // 
            
            
            
            CNNVD: CNNVD-201510-200

EXTERNAL IDS
db:NVDid:CVE-2015-6687
Trust: 2.8
db:SECTRACKid:1033796
Trust: 1.7
db:JVNDBid:JVNDB-2015-005244
Trust: 0.8
db:CNNVDid:CNNVD-201510-200
Trust: 0.7
db:ZDIid:ZDI-15-508
Trust: 0.3
db:ZDIid:ZDI-15-470
Trust: 0.3
db:ZDIid:ZDI-15-493
Trust: 0.3
db:ZDIid:ZDI-15-469
Trust: 0.3
db:ZDIid:ZDI-15-474
Trust: 0.3
db:ZDIid:ZDI-15-492
Trust: 0.3
db:BIDid:77064
Trust: 0.3
db:VULHUBid:VHN-84648
Trust: 0.1
sources:
            
            
            VULHUB: VHN-84648 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005244 // 
            
            
            
            CNNVD: CNNVD-201510-200 // 
            
            
            
            NVD: CVE-2015-6687

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 2.0
url:http://www.securitytracker.com/id/1033796
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6687
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20151014-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2015/at150035.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6687
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=17022
Trust: 0.8
url:http://www.adobe.com
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-469/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-470/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-474/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-492/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-493/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-508/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-84648 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005244 // 
            
            
            
            CNNVD: CNNVD-201510-200 // 
            
            
            
            NVD: CVE-2015-6687

CREDITS
AbdulAziz Hariri of HP Zero Day Initiative, Bill Finlayson of Vectra Networks, bilou working with VeriSign iDefense Labs, James Loureiro of MWR Labs, kdot working with HP's's Zero Day Initiative, Wei Lei and Wu Hongjun of Nanyang Technological University w
Trust: 0.3
sources:
            
            
            BID: 77064

SOURCES
db:VULHUBid:VHN-84648
db:BIDid:77064
db:JVNDBid:JVNDB-2015-005244
db:CNNVDid:CNNVD-201510-200
db:NVDid:CVE-2015-6687

LAST UPDATE DATE
2024-11-23T21:43:46.021000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-84648date:2020-05-18T00:00:00
db:BIDid:77064date:2015-10-26T17:00:00
db:JVNDBid:JVNDB-2015-005244date:2015-10-16T00:00:00
db:CNNVDid:CNNVD-201510-200date:2020-05-19T00:00:00
db:NVDid:CVE-2015-6687date:2024-11-21T02:35:26.610

SOURCES RELEASE DATE
db:VULHUBid:VHN-84648date:2015-10-14T00:00:00
db:BIDid:77064date:2015-10-13T00:00:00
db:JVNDBid:JVNDB-2015-005244date:2015-10-16T00:00:00
db:CNNVDid:CNNVD-201510-200date:2015-10-15T00:00:00
db:NVDid:CVE-2015-6687date:2015-10-14T23:59:08.937