Sign-up

ID

VAR-201605-0168


CVE

CVE-2016-1079


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerability in which important information is obtained from process memory

Trust: 0.8

sources: JVNDB: JVNDB-2016-002643

DESCRIPTION

Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1092. This vulnerability CVE-2016-1092 Is a different vulnerability.An attacker can retrieve important information from process memory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the app.removeToolButton method. By calling app.removeToolButton multiple times, it is possible to force Acrobat Pro DC to leak heap addresses. An attacker can exploit these issues to gain access to sensitive information that may aid in further attacks. are all products of Adobe (Adobe) in the United States. A memory leak vulnerability exists in several Adobe products

Trust: 2.61

sources: NVD: CVE-2016-1079 // JVNDB: JVNDB-2016-002643 // ZDI: ZDI-16-326 // BID: 90511 // VULHUB: VHN-89601

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30121

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.010.20060

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30121

Trust: 1.0

vendor:adobemodel:readerscope:lteversion:11.0.15

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.010.20060

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.15

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.16 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classic 15.006.30172 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.016.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classic 15.006.30172 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.016.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.16 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat pro dcscope: - version: -

Trust: 0.7

vendor:applemodel:mac os xscope: - version: -

Trust: 0.6

sources: ZDI: ZDI-16-326 // JVNDB: JVNDB-2016-002643 // CNNVD: CNNVD-201605-278 // NVD: CVE-2016-1079

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1079
value: HIGH

Trust: 1.0

NVD: CVE-2016-1079
value: HIGH

Trust: 0.8

ZDI: CVE-2016-1079
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201605-278
value: MEDIUM

Trust: 0.6

VULHUB: VHN-89601
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1079
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2016-1079
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-89601
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1079
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: ZDI: ZDI-16-326 // VULHUB: VHN-89601 // JVNDB: JVNDB-2016-002643 // CNNVD: CNNVD-201605-278 // NVD: CVE-2016-1079

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-89601 // JVNDB: JVNDB-2016-002643 // NVD: CVE-2016-1079

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201605-278

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201605-278

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-002643

PATCH
title:APSB16-14url:https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
Trust: 1.5
title:APSB16-14url:https://helpx.adobe.com/jp/security/products/reader/apsb16-14.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20160512.html
Trust: 0.8
title:Multiple Adobe Product memory leak vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61596
Trust: 0.6
sources:
            
            
            ZDI: ZDI-16-326 // 
            
            
            
            JVNDB: JVNDB-2016-002643 // 
            
            
            
            CNNVD: CNNVD-201605-278

EXTERNAL IDS
db:NVDid:CVE-2016-1079
Trust: 3.5
db:ZDIid:ZDI-16-326
Trust: 1.8
db:BIDid:90511
Trust: 1.4
db:SECTRACKid:1035828
Trust: 1.1
db:JVNDBid:JVNDB-2016-002643
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-3569
Trust: 0.7
db:CNNVDid:CNNVD-201605-278
Trust: 0.7
db:AUSCERTid:ESB-2016.1146
Trust: 0.6
db:VULHUBid:VHN-89601
Trust: 0.1
sources:
            
            
            ZDI: ZDI-16-326 // 
            
            
            
            VULHUB: VHN-89601 // 
            
            
            
            BID: 90511 // 
            
            
            
            JVNDB: JVNDB-2016-002643 // 
            
            
            
            CNNVD: CNNVD-201605-278 // 
            
            
            
            NVD: CVE-2016-1079

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb16-14.html
Trust: 2.4
url:http://www.securityfocus.com/bid/90511
Trust: 1.1
url:http://www.zerodayinitiative.com/advisories/zdi-16-326
Trust: 1.1
url:http://www.securitytracker.com/id/1035828
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1079
Trust: 0.8
url:https://www.ipa.go.jp/security/ciadr/vul/20160511-adobereader.html
Trust: 0.8
url:https://www.jpcert.or.jp/at/2016/at160023.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1079
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=18377
Trust: 0.8
url:https://www.auscert.org.au/render.html?it=34330
Trust: 0.6
url:http://www.adobe.com
Trust: 0.3
sources:
            
            
            ZDI: ZDI-16-326 // 
            
            
            
            VULHUB: VHN-89601 // 
            
            
            
            BID: 90511 // 
            
            
            
            JVNDB: JVNDB-2016-002643 // 
            
            
            
            CNNVD: CNNVD-201605-278 // 
            
            
            
            NVD: CVE-2016-1079

CREDITS
AbdulAziz Hariri - HPE Zero Day Initiative
Trust: 0.7
sources:
            
            
            ZDI: ZDI-16-326

SOURCES
db:ZDIid:ZDI-16-326
db:VULHUBid:VHN-89601
db:BIDid:90511
db:JVNDBid:JVNDB-2016-002643
db:CNNVDid:CNNVD-201605-278
db:NVDid:CVE-2016-1079

LAST UPDATE DATE
2025-04-13T23:02:58.276000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-16-326date:2016-05-10T00:00:00
db:VULHUBid:VHN-89601date:2016-12-01T00:00:00
db:BIDid:90511date:2016-07-06T14:39:00
db:JVNDBid:JVNDB-2016-002643date:2016-05-17T00:00:00
db:CNNVDid:CNNVD-201605-278date:2016-05-11T00:00:00
db:NVDid:CVE-2016-1079date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:ZDIid:ZDI-16-326date:2016-05-10T00:00:00
db:VULHUBid:VHN-89601date:2016-05-11T00:00:00
db:BIDid:90511date:2016-05-10T00:00:00
db:JVNDBid:JVNDB-2016-002643date:2016-05-17T00:00:00
db:CNNVDid:CNNVD-201605-278date:2016-05-11T00:00:00
db:NVDid:CVE-2016-1079date:2016-05-11T10:59:49.127