Sign-up

ID

VAR-201510-0362


CVE

CVE-2015-6691


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2015-005248

DESCRIPTION

Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621. This vulnerability CVE-2015-5586 , CVE-2015-6683 , CVE-2015-6684 , CVE-2015-6687 , CVE-2015-6688 , CVE-2015-6689 , CVE-2015-6690 , CVE-2015-7615 , CVE-2015-7617 ,and CVE-2015-7621 Is a different vulnerability. Supplementary information : CWE Vulnerability type by CWE-416: Use-after-free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAn attacker could execute arbitrary code. Adobe Acrobat and Reader are prone to multiple remote code-execution vulnerabilities. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. A use-after-free vulnerability exists in several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

Trust: 1.98

sources: NVD: CVE-2015-6691 // JVNDB: JVNDB-2015-005248 // BID: 77064 // VULHUB: VHN-84652

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat readerscope:eqversion:11.0.8

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.14

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.11

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.10

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.7

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.12

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.13

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.9

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.12

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.6

vendor:adobemodel:readerscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0

Trust: 0.3

sources: BID: 77064 // JVNDB: JVNDB-2015-005248 // CNNVD: CNNVD-201510-204 // NVD: CVE-2015-6691

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6691
value: HIGH

Trust: 1.0

NVD: CVE-2015-6691
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201510-204
value: CRITICAL

Trust: 0.6

VULHUB: VHN-84652
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-6691
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-84652
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-84652 // JVNDB: JVNDB-2015-005248 // CNNVD: CNNVD-201510-204 // NVD: CVE-2015-6691

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-84652 // JVNDB: JVNDB-2015-005248 // NVD: CVE-2015-6691

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201510-204

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201510-204

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005248

PATCH
title:APSB15-24url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 0.8
title:APSB15-24url:https://helpx.adobe.com/jp/security/products/reader/apsb15-24.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20151015.html
Trust: 0.8
title:Multiple Adobe Remediation measures for reusing vulnerabilities after product releaseurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58053
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-005248 // 
            
            
            
            CNNVD: CNNVD-201510-204

EXTERNAL IDS
db:NVDid:CVE-2015-6691
Trust: 2.8
db:SECTRACKid:1033796
Trust: 1.7
db:JVNDBid:JVNDB-2015-005248
Trust: 0.8
db:CNNVDid:CNNVD-201510-204
Trust: 0.7
db:ZDIid:ZDI-15-508
Trust: 0.3
db:ZDIid:ZDI-15-470
Trust: 0.3
db:ZDIid:ZDI-15-493
Trust: 0.3
db:ZDIid:ZDI-15-469
Trust: 0.3
db:ZDIid:ZDI-15-474
Trust: 0.3
db:ZDIid:ZDI-15-492
Trust: 0.3
db:BIDid:77064
Trust: 0.3
db:VULHUBid:VHN-84652
Trust: 0.1
sources:
            
            
            VULHUB: VHN-84652 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005248 // 
            
            
            
            CNNVD: CNNVD-201510-204 // 
            
            
            
            NVD: CVE-2015-6691

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 2.0
url:http://www.securitytracker.com/id/1033796
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6691
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20151014-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2015/at150035.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6691
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=17022
Trust: 0.8
url:http://www.adobe.com
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-469/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-470/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-474/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-492/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-493/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-508/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-84652 // 
            
            
            
            BID: 77064 // 
            
            
            
            JVNDB: JVNDB-2015-005248 // 
            
            
            
            CNNVD: CNNVD-201510-204 // 
            
            
            
            NVD: CVE-2015-6691

CREDITS
AbdulAziz Hariri of HP Zero Day Initiative, Bill Finlayson of Vectra Networks, bilou working with VeriSign iDefense Labs, James Loureiro of MWR Labs, kdot working with HP's's Zero Day Initiative, Wei Lei and Wu Hongjun of Nanyang Technological University w
Trust: 0.3
sources:
            
            
            BID: 77064

SOURCES
db:VULHUBid:VHN-84652
db:BIDid:77064
db:JVNDBid:JVNDB-2015-005248
db:CNNVDid:CNNVD-201510-204
db:NVDid:CVE-2015-6691

LAST UPDATE DATE
2024-11-23T21:43:45.660000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-84652date:2020-05-13T00:00:00
db:BIDid:77064date:2015-10-26T17:00:00
db:JVNDBid:JVNDB-2015-005248date:2015-10-16T00:00:00
db:CNNVDid:CNNVD-201510-204date:2020-05-14T00:00:00
db:NVDid:CVE-2015-6691date:2024-11-21T02:35:27.080

SOURCES RELEASE DATE
db:VULHUBid:VHN-84652date:2015-10-14T00:00:00
db:BIDid:77064date:2015-10-13T00:00:00
db:JVNDBid:JVNDB-2015-005248date:2015-10-16T00:00:00
db:CNNVDid:CNNVD-201510-204date:2015-10-15T00:00:00
db:NVDid:CVE-2015-6691date:2015-10-14T23:59:13.080