Sign-up

ID

VAR-201605-0115


CVE

CVE-2016-4096


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerabilities in arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2016-002681

DESCRIPTION

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105. This vulnerability is CVE-2016-1037 , CVE-2016-1063 , CVE-2016-1064 , CVE-2016-1071 , CVE-2016-1072 , CVE-2016-1073 , CVE-2016-1074 , CVE-2016-1076 , CVE-2016-1077 , CVE-2016-1078 , CVE-2016-1080 , CVE-2016-1081 , CVE-2016-1082 , CVE-2016-1083 , CVE-2016-1084 , CVE-2016-1085 , CVE-2016-1086 , CVE-2016-1088 , CVE-2016-1093 , CVE-2016-1095 , CVE-2016-1116 , CVE-2016-1118 , CVE-2016-1119 , CVE-2016-1120 , CVE-2016-1123 , CVE-2016-1124 , CVE-2016-1125 , CVE-2016-1126 , CVE-2016-1127 , CVE-2016-1128 , CVE-2016-1129 , CVE-2016-1130 , CVE-2016-4088 , CVE-2016-4089 , CVE-2016-4090 , CVE-2016-4093 , CVE-2016-4094 , CVE-2016-4097 , CVE-2016-4098 , CVE-2016-4099 , CVE-2016-4100 , CVE-2016-4101 , CVE-2016-4103 , CVE-2016-4104 ,and CVE-2016-4105 This is a different vulnerability.Arbitrary code execution or denial of service by an attacker ( Memory corruption ) May be in a state. Adobe Reader and Acrobat are prone to multiple security vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application or gain access to sensitive information. Failed exploit attempts will likely result in denial-of-service conditions. Note: This issue was previously titled 'Adobe Reader and Acrobat APSB16-14 Multiple Unspecified Memory Corruption Vulnerabilities'. The title has been changed to better reflect the vulnerability information. Adobe Acrobat DC, etc. are all products of Adobe (Adobe) in the United States. Acrobat DC is a desktop PDF solution; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. A memory corruption vulnerability exists in several Adobe products

Trust: 2.07

sources: NVD: CVE-2016-4096 // JVNDB: JVNDB-2016-002681 // BID: 90509 // VULHUB: VHN-92915 // VULMON: CVE-2016-4096

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30121

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.010.20060

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30121

Trust: 1.0

vendor:adobemodel:readerscope:lteversion:11.0.15

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.010.20060

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.15

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.16 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classical 15.006.30172 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.016.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classical 15.006.30172 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.016.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.16 (windows/macintosh)

Trust: 0.8

vendor:microsoftmodel:windowsscope: - version: -

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.16.20039

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:readerscope:neversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.16.20039

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.05

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.3

sources: BID: 90509 // JVNDB: JVNDB-2016-002681 // CNNVD: CNNVD-201605-316 // NVD: CVE-2016-4096

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4096
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-4096
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201605-316
value: CRITICAL

Trust: 0.6

VULHUB: VHN-92915
value: HIGH

Trust: 0.1

VULMON: CVE-2016-4096
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-4096
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-92915
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4096
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-92915 // VULMON: CVE-2016-4096 // JVNDB: JVNDB-2016-002681 // CNNVD: CNNVD-201605-316 // NVD: CVE-2016-4096

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-92915 // JVNDB: JVNDB-2016-002681 // NVD: CVE-2016-4096

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201605-316

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201605-316

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-002681

PATCH
title:APSB16-14url:https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
Trust: 0.8
title:APSB16-14url:https://helpx.adobe.com/jp/security/products/reader/apsb16-14.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20160512.html
Trust: 0.8
title:Multiple Adobe Product memory corruption vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61634
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-002681 // 
            
            
            
            CNNVD: CNNVD-201605-316

EXTERNAL IDS
db:NVDid:CVE-2016-4096
Trust: 2.9
db:SECTRACKid:1035828
Trust: 1.2
db:JVNDBid:JVNDB-2016-002681
Trust: 0.8
db:CNNVDid:CNNVD-201605-316
Trust: 0.7
db:AUSCERTid:ESB-2016.1146
Trust: 0.6
db:BIDid:90509
Trust: 0.4
db:ZDIid:ZDI-16-321
Trust: 0.3
db:ZDIid:ZDI-16-319
Trust: 0.3
db:ZDIid:ZDI-16-320
Trust: 0.3
db:ZDIid:ZDI-16-327
Trust: 0.3
db:ZDIid:ZDI-16-329
Trust: 0.3
db:ZDIid:ZDI-16-324
Trust: 0.3
db:ZDIid:ZDI-16-322
Trust: 0.3
db:ZDIid:ZDI-16-311
Trust: 0.3
db:ZDIid:ZDI-16-325
Trust: 0.3
db:VULHUBid:VHN-92915
Trust: 0.1
db:VULMONid:CVE-2016-4096
Trust: 0.1
sources:
            
            
            VULHUB: VHN-92915 // 
            
            
            
            VULMON: CVE-2016-4096 // 
            
            
            
            BID: 90509 // 
            
            
            
            JVNDB: JVNDB-2016-002681 // 
            
            
            
            CNNVD: CNNVD-201605-316 // 
            
            
            
            NVD: CVE-2016-4096

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
Trust: 2.1
url:http://www.securitytracker.com/id/1035828
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4096
Trust: 0.8
url:https://www.ipa.go.jp/security/ciadr/vul/20160511-adobereader.html
Trust: 0.8
url:https://www.jpcert.or.jp/at/2016/at160023.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4096
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=18377
Trust: 0.8
url:https://www.auscert.org.au/render.html?it=34330
Trust: 0.6
url:http://www.adobe.com/products/acrobat.html
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
url:http://get.adobe.com/reader/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-311
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-319
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-320
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-321
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-322
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-324
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-325
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-327
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-329
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.securityfocus.com/bid/90509
Trust: 0.1
sources:
            
            
            VULHUB: VHN-92915 // 
            
            
            
            VULMON: CVE-2016-4096 // 
            
            
            
            BID: 90509 // 
            
            
            
            JVNDB: JVNDB-2016-002681 // 
            
            
            
            CNNVD: CNNVD-201605-316 // 
            
            
            
            NVD: CVE-2016-4096

CREDITS
Ke Liu of Tencent's Xuanwu LAB
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201605-316

SOURCES
db:VULHUBid:VHN-92915
db:VULMONid:CVE-2016-4096
db:BIDid:90509
db:JVNDBid:JVNDB-2016-002681
db:CNNVDid:CNNVD-201605-316
db:NVDid:CVE-2016-4096

LAST UPDATE DATE
2025-04-13T23:03:02.453000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-92915date:2016-12-01T00:00:00
db:VULMONid:CVE-2016-4096date:2016-12-01T00:00:00
db:BIDid:90509date:2016-05-10T00:00:00
db:JVNDBid:JVNDB-2016-002681date:2016-05-17T00:00:00
db:CNNVDid:CNNVD-201605-316date:2016-05-11T00:00:00
db:NVDid:CVE-2016-4096date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-92915date:2016-05-11T00:00:00
db:VULMONid:CVE-2016-4096date:2016-05-11T00:00:00
db:BIDid:90509date:2016-05-10T00:00:00
db:JVNDBid:JVNDB-2016-002681date:2016-05-17T00:00:00
db:CNNVDid:CNNVD-201605-316date:2016-05-11T00:00:00
db:NVDid:CVE-2016-4096date:2016-05-11T11:00:47.653