Sign-up

ID

VAR-201607-0063


CVE

CVE-2016-4215


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat In JavaScript API Vulnerability bypassing execution restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2016-003622

DESCRIPTION

Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors. Supplementary information : CWE Vulnerability types by CWE-254: Security Features ( Security features ) and CWE-284: Improper Access Control ( Improper access control ) Has been identified. http://cwe.mitre.org/data/definitions/254.html http://cwe.mitre.org/data/definitions/284.htmlBy the attacker, JavaScript API Execution restrictions may be bypassed. Adobe Reader and Acrobat are prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Security flaws exist in several Adobe products

Trust: 1.98

sources: NVD: CVE-2016-4215 // JVNDB: JVNDB-2016-003622 // BID: 91712 // VULHUB: VHN-93034

AFFECTED PRODUCTS

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30174

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.016.20045

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.016.20045

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30174

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.16

Trust: 1.0

vendor:adobemodel:readerscope:lteversion:11.0.16

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.17 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classical 15.006.30198 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.017.20050 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classical 15.006.30198 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.017.20050 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.17 (windows/macintosh)

Trust: 0.8

vendor:microsoftmodel:windowsscope: - version: -

Trust: 0.6

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30174

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.16.20045

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:neversion:11.0.17

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.17.20050

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30174

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.6.30198

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.2

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.16.20045

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.17.20050

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.05

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.6.30198

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:11.0.17

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.3

sources: BID: 91712 // JVNDB: JVNDB-2016-003622 // CNNVD: CNNVD-201607-272 // NVD: CVE-2016-4215

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4215
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-4215
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201607-272
value: CRITICAL

Trust: 0.6

VULHUB: VHN-93034
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-4215
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: CVE-2016-4215
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-93034
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4215
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-93034 // JVNDB: JVNDB-2016-003622 // CNNVD: CNNVD-201607-272 // NVD: CVE-2016-4215

PROBLEMTYPE DATA

problemtype:CWE-254

Trust: 1.1

problemtype:CWE-284

Trust: 1.1

problemtype:CWE-Other

Trust: 0.8

sources: VULHUB: VHN-93034 // JVNDB: JVNDB-2016-003622 // NVD: CVE-2016-4215

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201607-272

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201607-272

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-003622

PATCH
title:APSB16-26url:https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
Trust: 0.8
title:APSB16-26url:https://helpx.adobe.com/jp/security/products/acrobat/apsb16-26.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20160714.html
Trust: 0.8
title:Multiple Adobe Product safety bypass vulnerability repair measuresurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62855
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-003622 // 
            
            
            
            CNNVD: CNNVD-201607-272

EXTERNAL IDS
db:NVDid:CVE-2016-4215
Trust: 2.8
db:BIDid:91712
Trust: 1.4
db:SECTRACKid:1036281
Trust: 1.1
db:JVNDBid:JVNDB-2016-003622
Trust: 0.8
db:CNNVDid:CNNVD-201607-272
Trust: 0.7
db:VULHUBid:VHN-93034
Trust: 0.1
sources:
            
            
            VULHUB: VHN-93034 // 
            
            
            
            BID: 91712 // 
            
            
            
            JVNDB: JVNDB-2016-003622 // 
            
            
            
            CNNVD: CNNVD-201607-272 // 
            
            
            
            NVD: CVE-2016-4215

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
Trust: 2.0
url:http://www.securityfocus.com/bid/91712
Trust: 1.1
url:http://www.securitytracker.com/id/1036281
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4215
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20160713-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2016/at160030.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4215
Trust: 0.8
url:http://www.npa.go.jp/cyberpolice/topics/?seq=18716
Trust: 0.8
url:http://www.adobe.com/products/acrobat.html
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
url:http://get.adobe.com/reader/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-93034 // 
            
            
            
            BID: 91712 // 
            
            
            
            JVNDB: JVNDB-2016-003622 // 
            
            
            
            CNNVD: CNNVD-201607-272 // 
            
            
            
            NVD: CVE-2016-4215

CREDITS
Alex Inführ and Masato Kinugawa of Cure53.
Trust: 0.3
sources:
            
            
            BID: 91712

SOURCES
db:VULHUBid:VHN-93034
db:BIDid:91712
db:JVNDBid:JVNDB-2016-003622
db:CNNVDid:CNNVD-201607-272
db:NVDid:CVE-2016-4215

LAST UPDATE DATE
2025-04-13T23:02:54.218000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-93034date:2017-09-01T00:00:00
db:BIDid:91712date:2016-07-12T00:00:00
db:JVNDBid:JVNDB-2016-003622date:2016-07-15T00:00:00
db:CNNVDid:CNNVD-201607-272date:2016-07-13T00:00:00
db:NVDid:CVE-2016-4215date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-93034date:2016-07-13T00:00:00
db:BIDid:91712date:2016-07-12T00:00:00
db:JVNDBid:JVNDB-2016-003622date:2016-07-15T00:00:00
db:CNNVDid:CNNVD-201607-272date:2016-07-13T00:00:00
db:NVDid:CVE-2016-4215date:2016-07-13T02:00:23.947