Sign-up

ID

VAR-201605-0112


CVE

CVE-2016-4092


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Heap-based buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-002678

DESCRIPTION

Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4091. This vulnerability CVE-2016-4091 Is a different vulnerability.An attacker could execute arbitrary code. Failed attempts will likely cause a denial-of-service condition. Adobe Acrobat DC, etc. are all products of Adobe (Adobe) in the United States. Acrobat DC is a desktop PDF solution; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Trust: 1.98

sources: NVD: CVE-2016-4092 // JVNDB: JVNDB-2016-002678 // BID: 90508 // VULHUB: VHN-92911

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30121

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.010.20060

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30121

Trust: 1.0

vendor:adobemodel:readerscope:lteversion:11.0.15

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.010.20060

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.15

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.16 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classic 15.006.30172 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.016.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classic 15.006.30172 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.016.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.16 (windows/macintosh)

Trust: 0.8

vendor:microsoftmodel:windowsscope: - version: -

Trust: 0.6

sources: JVNDB: JVNDB-2016-002678 // CNNVD: CNNVD-201605-313 // NVD: CVE-2016-4092

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4092
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-4092
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201605-313
value: CRITICAL

Trust: 0.6

VULHUB: VHN-92911
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-4092
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-92911
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4092
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-92911 // JVNDB: JVNDB-2016-002678 // CNNVD: CNNVD-201605-313 // NVD: CVE-2016-4092

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-92911 // JVNDB: JVNDB-2016-002678 // NVD: CVE-2016-4092

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201605-313

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201605-313

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-002678

PATCH
title:APSB16-14url:https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
Trust: 0.8
title:APSB16-14url:https://helpx.adobe.com/jp/security/products/reader/apsb16-14.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20160512.html
Trust: 0.8
title:Multiple Adobe Product-based patch-based buffer overflow vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61631
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-002678 // 
            
            
            
            CNNVD: CNNVD-201605-313

EXTERNAL IDS
db:NVDid:CVE-2016-4092
Trust: 2.8
db:BIDid:90508
Trust: 1.4
db:SECTRACKid:1035828
Trust: 1.1
db:JVNDBid:JVNDB-2016-002678
Trust: 0.8
db:CNNVDid:CNNVD-201605-313
Trust: 0.7
db:AUSCERTid:ESB-2016.1146
Trust: 0.6
db:VULHUBid:VHN-92911
Trust: 0.1
sources:
            
            
            VULHUB: VHN-92911 // 
            
            
            
            BID: 90508 // 
            
            
            
            JVNDB: JVNDB-2016-002678 // 
            
            
            
            CNNVD: CNNVD-201605-313 // 
            
            
            
            NVD: CVE-2016-4092

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
Trust: 1.7
url:http://www.securityfocus.com/bid/90508
Trust: 1.1
url:http://www.securitytracker.com/id/1035828
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4092
Trust: 0.8
url:https://www.ipa.go.jp/security/ciadr/vul/20160511-adobereader.html
Trust: 0.8
url:https://www.jpcert.or.jp/at/2016/at160023.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4092
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=18377
Trust: 0.8
url:https://www.auscert.org.au/render.html?it=34330
Trust: 0.6
url:http://www.adobe.com/products/flash/
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
sources:
            
            
            VULHUB: VHN-92911 // 
            
            
            
            BID: 90508 // 
            
            
            
            JVNDB: JVNDB-2016-002678 // 
            
            
            
            CNNVD: CNNVD-201605-313 // 
            
            
            
            NVD: CVE-2016-4092

CREDITS
Ke Liu of Tencent's Xuanwu LAB
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201605-313

SOURCES
db:VULHUBid:VHN-92911
db:BIDid:90508
db:JVNDBid:JVNDB-2016-002678
db:CNNVDid:CNNVD-201605-313
db:NVDid:CVE-2016-4092

LAST UPDATE DATE
2025-04-13T23:03:02.339000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-92911date:2016-12-02T00:00:00
db:BIDid:90508date:2016-05-10T00:00:00
db:JVNDBid:JVNDB-2016-002678date:2016-05-17T00:00:00
db:CNNVDid:CNNVD-201605-313date:2016-05-11T00:00:00
db:NVDid:CVE-2016-4092date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-92911date:2016-05-11T00:00:00
db:BIDid:90508date:2016-05-10T00:00:00
db:JVNDBid:JVNDB-2016-002678date:2016-05-17T00:00:00
db:CNNVDid:CNNVD-201605-313date:2016-05-11T00:00:00
db:NVDid:CVE-2016-4092date:2016-05-11T11:00:44.200