Sign-up

ID

VAR-201607-0124


CVE

CVE-2016-4209


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Heap-based buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-003612

DESCRIPTION

Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts likely result in denial-of-service conditions. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Trust: 1.98

sources: NVD: CVE-2016-4209 // JVNDB: JVNDB-2016-003612 // BID: 91711 // VULHUB: VHN-93028

AFFECTED PRODUCTS

vendor:adobemodel:acrobatscope:lteversion:11.0.16

Trust: 1.0

vendor:adobemodel:readerscope:lteversion:11.0.16

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.016.20045

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30174

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30174

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.016.20045

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.17 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classic 15.006.30198 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.017.20050 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classic 15.006.30198 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.017.20050 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.17 (windows/macintosh)

Trust: 0.8

vendor:applemodel:mac os xscope: - version: -

Trust: 0.6

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30174

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.16.20045

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:neversion:11.0.17

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.17.20050

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobat readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30174

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.6.30198

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.2

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.16.20045

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.17.20050

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.05

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.6.30198

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:11.0.17

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.3

sources: BID: 91711 // JVNDB: JVNDB-2016-003612 // CNNVD: CNNVD-201607-266 // NVD: CVE-2016-4209

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4209
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-4209
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201607-266
value: CRITICAL

Trust: 0.6

VULHUB: VHN-93028
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-4209
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: CVE-2016-4209
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-93028
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4209
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: CVE-2016-4209
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-93028 // JVNDB: JVNDB-2016-003612 // CNNVD: CNNVD-201607-266 // NVD: CVE-2016-4209

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-93028 // JVNDB: JVNDB-2016-003612 // NVD: CVE-2016-4209

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201607-266

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201607-266

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-003612

PATCH
title:APSB16-26url:https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
Trust: 0.8
title:APSB16-26url:https://helpx.adobe.com/jp/security/products/acrobat/apsb16-26.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20160714.html
Trust: 0.8
title:Multiple Adobe Product-based patch-based buffer overflow vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62849
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-003612 // 
            
            
            
            CNNVD: CNNVD-201607-266

EXTERNAL IDS
db:NVDid:CVE-2016-4209
Trust: 2.8
db:BIDid:91711
Trust: 1.4
db:SECTRACKid:1036281
Trust: 1.1
db:JVNDBid:JVNDB-2016-003612
Trust: 0.8
db:CNNVDid:CNNVD-201607-266
Trust: 0.7
db:VULHUBid:VHN-93028
Trust: 0.1
sources:
            
            
            VULHUB: VHN-93028 // 
            
            
            
            BID: 91711 // 
            
            
            
            JVNDB: JVNDB-2016-003612 // 
            
            
            
            CNNVD: CNNVD-201607-266 // 
            
            
            
            NVD: CVE-2016-4209

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
Trust: 2.0
url:http://www.securityfocus.com/bid/91711
Trust: 1.1
url:http://www.securitytracker.com/id/1036281
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4209
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20160713-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2016/at160030.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4209
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=18716
Trust: 0.8
url:http://www.adobe.com/products/acrobat/
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
url:http://get.adobe.com/reader/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-93028 // 
            
            
            
            BID: 91711 // 
            
            
            
            JVNDB: JVNDB-2016-003612 // 
            
            
            
            CNNVD: CNNVD-201607-266 // 
            
            
            
            NVD: CVE-2016-4209

CREDITS
Ke Liu of Tencent's Xuanwu LAB.
Trust: 0.3
sources:
            
            
            BID: 91711

SOURCES
db:VULHUBid:VHN-93028
db:BIDid:91711
db:JVNDBid:JVNDB-2016-003612
db:CNNVDid:CNNVD-201607-266
db:NVDid:CVE-2016-4209

LAST UPDATE DATE
2024-11-23T21:43:00.341000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-93028date:2017-09-01T00:00:00
db:BIDid:91711date:2016-07-12T00:00:00
db:JVNDBid:JVNDB-2016-003612date:2016-07-14T00:00:00
db:CNNVDid:CNNVD-201607-266date:2016-07-13T00:00:00
db:NVDid:CVE-2016-4209date:2024-11-21T02:51:38.010

SOURCES RELEASE DATE
db:VULHUBid:VHN-93028date:2016-07-13T00:00:00
db:BIDid:91711date:2016-07-12T00:00:00
db:JVNDBid:JVNDB-2016-003612date:2016-07-14T00:00:00
db:CNNVDid:CNNVD-201607-266date:2016-07-13T00:00:00
db:NVDid:CVE-2016-4209date:2016-07-13T02:00:18.527