Sign-up

ID

VAR-201610-0137


CVE

CVE-2016-7854


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2016-005606

DESCRIPTION

Windows and Mac OS X Run on Adobe Reader and Acrobat Any code that could be executed or service disruption ( Memory corruption ) There are vulnerabilities that are put into a state. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6977 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7001 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7011 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 , CVE-2016-7019 , CVE-2016-7852 ,and CVE-2016-7853 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of JPEG2000 images. The process does not properly validate user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Adobe Acrobat and Reader are prone to multiple unspecified memory-corruption vulnerabilities. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. The following products and versions are affected: Adobe Reader XI and Acrobat XI prior to 11.0.18; Acrobat and Acrobat Reader DC Classic prior to 15.006.30243; Acrobat and Acrobat Reader DC Continuous prior to 15.020.20039

Trust: 1.71

sources: JVNDB: JVNDB-2016-005606 // ZDI: ZDI-16-573 // BID: 93496 // VULHUB: VHN-96674

AFFECTED PRODUCTS

vendor:adobemodel:readerscope:lteversion:11.0.17

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.017.20053

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30201

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.17

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.017.20053

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30201

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.18 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classic 15.006.30243 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.020.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classic 15.006.30243 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.020.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.18 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope: - version: -

Trust: 0.7

vendor:applemodel:mac os xscope: - version: -

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.20.20039

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30201

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.17.20053

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.6.30243

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:readerscope:neversion:11.0.18

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30201

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.17

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.20.20039

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:11.0.18

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.17

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.17.20053

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.05

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.6.30243

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.3

sources: ZDI: ZDI-16-573 // BID: 93496 // JVNDB: JVNDB-2016-005606 // CNNVD: CNNVD-201610-686 // NVD: CVE-2016-7854

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-7854
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-7854
value: CRITICAL

Trust: 0.8

ZDI: CVE-2016-7854
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-201610-686
value: CRITICAL

Trust: 0.6

VULHUB: VHN-96674
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-7854
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

ZDI: CVE-2016-7854
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

VULHUB: VHN-96674
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-7854
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: ZDI: ZDI-16-573 // VULHUB: VHN-96674 // JVNDB: JVNDB-2016-005606 // CNNVD: CNNVD-201610-686 // NVD: CVE-2016-7854

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-96674 // JVNDB: JVNDB-2016-005606 // NVD: CVE-2016-7854

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-686

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201610-686

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-005606

PATCH
title:APSB16-33url:https://helpx.adobe.com/security/products/acrobat/apsb16-33.html
Trust: 1.5
title:APSB16-33url:https://helpx.adobe.com/jp/security/products/acrobat/apsb16-33.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20161013.html
Trust: 0.8
title:Adobe Reader  and Acrobat Repair measures for memory corruption vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65052
Trust: 0.6
sources:
            
            
            ZDI: ZDI-16-573 // 
            
            
            
            JVNDB: JVNDB-2016-005606 // 
            
            
            
            CNNVD: CNNVD-201610-686

EXTERNAL IDS
db:NVDid:CVE-2016-7854
Trust: 3.5
db:BIDid:93496
Trust: 1.4
db:ZDIid:ZDI-16-573
Trust: 1.0
db:JVNDBid:JVNDB-2016-005606
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-4038
Trust: 0.7
db:CNNVDid:CNNVD-201610-686
Trust: 0.7
db:ZDIid:ZDI-16-542
Trust: 0.3
db:ZDIid:ZDI-16-565
Trust: 0.3
db:ZDIid:ZDI-16-541
Trust: 0.3
db:ZDIid:ZDI-16-564
Trust: 0.3
db:ZDIid:ZDI-16-538
Trust: 0.3
db:ZDIid:ZDI-16-553
Trust: 0.3
db:ZDIid:ZDI-16-557
Trust: 0.3
db:ZDIid:ZDI-16-562
Trust: 0.3
db:ZDIid:ZDI-16-540
Trust: 0.3
db:ZDIid:ZDI-16-566
Trust: 0.3
db:ZDIid:ZDI-16-550
Trust: 0.3
db:ZDIid:ZDI-16-543
Trust: 0.3
db:ZDIid:ZDI-16-555
Trust: 0.3
db:ZDIid:ZDI-16-567
Trust: 0.3
db:ZDIid:ZDI-16-558
Trust: 0.3
db:ZDIid:ZDI-16-539
Trust: 0.3
db:VULHUBid:VHN-96674
Trust: 0.1
sources:
            
            
            ZDI: ZDI-16-573 // 
            
            
            
            VULHUB: VHN-96674 // 
            
            
            
            BID: 93496 // 
            
            
            
            JVNDB: JVNDB-2016-005606 // 
            
            
            
            CNNVD: CNNVD-201610-686 // 
            
            
            
            NVD: CVE-2016-7854

REFERENCES
url:https://helpx.adobe.com/security/products/acrobat/apsb16-33.html
Trust: 2.4
url:http://www.securityfocus.com/bid/93496
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7854
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20161012-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2016/at160041.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-7854
Trust: 0.8
url:http://www.adobe.com/products/flash/
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
url:https://helpx.adobe.com/security/products/acrobat/apsb16-33.html 
Trust: 0.3
url:www.zerodayinitiative.com/advisories/zdi-16-538/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-539/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-540/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-541/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-542/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-543/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-550/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-553/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-555/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-557/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-558/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-562/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-564/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-565/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-566/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-567/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-16-573/
Trust: 0.3
sources:
            
            
            ZDI: ZDI-16-573 // 
            
            
            
            VULHUB: VHN-96674 // 
            
            
            
            BID: 93496 // 
            
            
            
            JVNDB: JVNDB-2016-005606 // 
            
            
            
            CNNVD: CNNVD-201610-686 // 
            
            
            
            NVD: CVE-2016-7854

CREDITS
kdot
Trust: 0.7
sources:
            
            
            ZDI: ZDI-16-573

SOURCES
db:ZDIid:ZDI-16-573
db:VULHUBid:VHN-96674
db:BIDid:93496
db:JVNDBid:JVNDB-2016-005606
db:CNNVDid:CNNVD-201610-686
db:NVDid:CVE-2016-7854

LAST UPDATE DATE
2025-04-13T23:02:02.348000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-16-573date:2016-11-01T00:00:00
db:VULHUBid:VHN-96674date:2016-11-28T00:00:00
db:BIDid:93496date:2016-11-24T01:07:00
db:JVNDBid:JVNDB-2016-005606date:2016-10-25T00:00:00
db:CNNVDid:CNNVD-201610-686date:2016-10-24T00:00:00
db:NVDid:CVE-2016-7854date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:ZDIid:ZDI-16-573date:2016-11-01T00:00:00
db:VULHUBid:VHN-96674date:2016-10-21T00:00:00
db:BIDid:93496date:2016-10-11T00:00:00
db:JVNDBid:JVNDB-2016-005606date:2016-10-25T00:00:00
db:CNNVDid:CNNVD-201610-686date:2016-10-24T00:00:00
db:NVDid:CVE-2016-7854date:2016-10-21T17:59:04.310