Sign-up

ID

VAR-201512-0436


CVE

CVE-2015-8458


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat of AGM.dll Heap-based buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2015-006484

DESCRIPTION

Heap-based buffer overflow in AGM.dll in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2015-6696 and CVE-2015-6698. This vulnerability CVE-2015-6696 and CVE-2015-6698 Is a different vulnerability.By attackers, multiple layers PDF Arbitrary code may be executed through the documentation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within AGM.dll. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Acrobat DC, etc. are all products of Adobe (Adobe) in the United States. Acrobat DC is a desktop PDF solution; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. 15 and earlier versions

Trust: 2.61

sources: NVD: CVE-2015-8458 // JVNDB: JVNDB-2015-006484 // ZDI: ZDI-15-637 // BID: 79208 // VULHUB: VHN-86419

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:10.1.15

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:10.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.006.30060

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:15.009.20069

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:gteversion:15.008.20082

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat readerscope:lteversion:11.0.12

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:ltversion:15.006.30094

Trust: 1.0

vendor:adobemodel:acrobatscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat readerscope:gteversion:11.0.0

Trust: 1.0

vendor:adobemodel:acrobat dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:(windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:11.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:acrobatscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:xi desktop 11.0.13

Trust: 0.8

vendor:adobemodel:acrobatscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat dcscope:eqversion:classic 2015.006.30094

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:10.x (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:eqversion:continuous 2015.009.20069

Trust: 0.8

vendor:adobemodel:readerscope:eqversion:x desktop 10.1.16

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope: - version: -

Trust: 0.7

vendor:adobemodel:acrobat readerscope:eqversion:11.0.10

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.11

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.14

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.12

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.10

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.11

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.13

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.9

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:11.0.12

Trust: 0.6

vendor:adobemodel:acrobat readerscope:eqversion:10.1.15

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:10.1.14

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.9

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.13

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:2015.8.20082

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:2015.006.30094

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.15

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:2015.6.30060

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:2015.006.30094

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:10.1.16

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.11

Trust: 0.3

vendor:adobemodel:readerscope:neversion:11.0.13

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.14

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.3

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:readerscope:neversion:10.1.16

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.5

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:2015.007.20033

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.13

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.8

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.11

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:2015.006.30060

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.05

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:2015.009.20069

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:2015.006.30033

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:10.1.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.9

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:2015.009.20069

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:2015.006.30033

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:2015.008.20082

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.7

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:2015.007.20033

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:10.1.15

Trust: 0.3

sources: ZDI: ZDI-15-637 // BID: 79208 // JVNDB: JVNDB-2015-006484 // CNNVD: CNNVD-201512-458 // NVD: CVE-2015-8458

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-8458
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-8458
value: MEDIUM

Trust: 0.8

ZDI: CVE-2015-8458
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201512-458
value: MEDIUM

Trust: 0.6

VULHUB: VHN-86419
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-8458
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 2.5

VULHUB: VHN-86419
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-15-637 // VULHUB: VHN-86419 // JVNDB: JVNDB-2015-006484 // CNNVD: CNNVD-201512-458 // NVD: CVE-2015-8458

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:CWE-119

Trust: 0.9

sources: VULHUB: VHN-86419 // JVNDB: JVNDB-2015-006484 // NVD: CVE-2015-8458

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201512-458

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201512-458

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006484

PATCH
title:APSB15-24url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 1.5
title:APSB15-24url:https://helpx.adobe.com/jp/security/products/reader/apsb15-24.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20151015.html
Trust: 0.8
title:Multiple Adobe Product-based patch-based buffer overflow vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59245
Trust: 0.6
sources:
            
            
            ZDI: ZDI-15-637 // 
            
            
            
            JVNDB: JVNDB-2015-006484 // 
            
            
            
            CNNVD: CNNVD-201512-458

EXTERNAL IDS
db:NVDid:CVE-2015-8458
Trust: 3.5
db:ZDIid:ZDI-15-637
Trust: 2.7
db:BIDid:79208
Trust: 2.0
db:JVNDBid:JVNDB-2015-006484
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-3019
Trust: 0.7
db:CNNVDid:CNNVD-201512-458
Trust: 0.7
db:VULHUBid:VHN-86419
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-637 // 
            
            
            
            VULHUB: VHN-86419 // 
            
            
            
            BID: 79208 // 
            
            
            
            JVNDB: JVNDB-2015-006484 // 
            
            
            
            CNNVD: CNNVD-201512-458 // 
            
            
            
            NVD: CVE-2015-8458

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb15-24.html
Trust: 2.7
url:http://www.securityfocus.com/bid/79208
Trust: 1.7
url:http://www.zerodayinitiative.com/advisories/zdi-15-637
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8458
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20151014-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2015/at150035.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8458
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=17022
Trust: 0.8
url:http://www.adobe.com
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-637/
Trust: 0.3
sources:
            
            
            ZDI: ZDI-15-637 // 
            
            
            
            VULHUB: VHN-86419 // 
            
            
            
            BID: 79208 // 
            
            
            
            JVNDB: JVNDB-2015-006484 // 
            
            
            
            CNNVD: CNNVD-201512-458 // 
            
            
            
            NVD: CVE-2015-8458

CREDITS
Fritz Sands of the Zero Day Initiative.
Trust: 0.9
sources:
            
            
            BID: 79208 // 
            
            
            
            CNNVD: CNNVD-201512-458

SOURCES
db:ZDIid:ZDI-15-637
db:VULHUBid:VHN-86419
db:BIDid:79208
db:JVNDBid:JVNDB-2015-006484
db:CNNVDid:CNNVD-201512-458
db:NVDid:CVE-2015-8458

LAST UPDATE DATE
2024-11-23T22:22:48.364000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-637date:2015-12-14T00:00:00
db:VULHUBid:VHN-86419date:2020-05-19T00:00:00
db:BIDid:79208date:2015-12-14T00:00:00
db:JVNDBid:JVNDB-2015-006484date:2015-12-22T00:00:00
db:CNNVDid:CNNVD-201512-458date:2020-05-20T00:00:00
db:NVDid:CVE-2015-8458date:2024-11-21T02:38:35.273

SOURCES RELEASE DATE
db:ZDIid:ZDI-15-637date:2015-12-14T00:00:00
db:VULHUBid:VHN-86419date:2015-12-21T00:00:00
db:BIDid:79208date:2015-12-14T00:00:00
db:JVNDBid:JVNDB-2015-006484date:2015-12-22T00:00:00
db:CNNVDid:CNNVD-201512-458date:2015-12-16T00:00:00
db:NVDid:CVE-2015-8458date:2015-12-21T11:59:13.080