Details of VAR-201610-0457

ID

VAR-201610-0457

CVE

CVE-2016-6977

TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Vulnerable to arbitrary code execution

Trust: 0.8

sources: JVNDB: JVNDB-2016-005283

DESCRIPTION

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019. This vulnerability CVE-2016-6940 , CVE-2016-6941 , CVE-2016-6942 , CVE-2016-6943 , CVE-2016-6947 , CVE-2016-6948 , CVE-2016-6950 , CVE-2016-6951 , CVE-2016-6954 , CVE-2016-6955 , CVE-2016-6956 , CVE-2016-6959 , CVE-2016-6960 , CVE-2016-6966 , CVE-2016-6970 , CVE-2016-6972 , CVE-2016-6973 , CVE-2016-6974 , CVE-2016-6975 , CVE-2016-6976 , CVE-2016-6978 , CVE-2016-6995 , CVE-2016-6996 , CVE-2016-6997 , CVE-2016-6998 , CVE-2016-7000 , CVE-2016-7001 , CVE-2016-7002 , CVE-2016-7003 , CVE-2016-7004 , CVE-2016-7005 , CVE-2016-7006 , CVE-2016-7007 , CVE-2016-7008 , CVE-2016-7009 , CVE-2016-7010 , CVE-2016-7011 , CVE-2016-7012 , CVE-2016-7013 , CVE-2016-7014 , CVE-2016-7015 , CVE-2016-7016 , CVE-2016-7017 , CVE-2016-7018 ,and CVE-2016-7019 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the AXSLE library. The process does not properly validate user-supplied data which can result in a read past the end of an allocated object. Failed attacks may cause a denial-of-service condition. The title has been changed to better reflect the vulnerability information. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Trust: 2.61

sources: NVD: CVE-2016-6977 // JVNDB: JVNDB-2016-005283 // ZDI: ZDI-16-543 // BID: 93496 // VULHUB: VHN-95797

AFFECTED PRODUCTS

vendor:	adobe	model:	reader	scope:	lte	version:	11.0.17	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	lte	version:	15.017.20053	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	lte	version:	15.006.30201	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	lte	version:	11.0.17	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	lte	version:	15.017.20053	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	lte	version:	15.006.30201	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	lt	version:	xi desktop 11.0.18 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	classic 15.006.30243 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	continuous track 15.020.20039 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	classic 15.006.30243 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	continuous track 15.020.20039 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	lt	version:	xi desktop 11.0.18 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	-	version:	-	Trust: 0.7
vendor:	apple	model:	mac os x	scope:	-	version:	-	Trust: 0.6
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.13	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.6	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.09	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30097	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	ne	version:	15.20.20039	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30172	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30201	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.10.20059	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.010.20056	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30121	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.10	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.4	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.14	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.006.30119	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.16.20039	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.1	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.17.20053	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.9.20077	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	ne	version:	15.6.30243	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.10.20060	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30097	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.16	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.4	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.10	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.14	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	ne	version:	11.0.18	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30201	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.10.20059	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.12	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.15	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.08	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.16	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.17	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	ne	version:	15.20.20039	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	ne	version:	11.0.18	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30172	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.10.20060	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.2	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.15	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.11	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.010.20056	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.7	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.17	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.13	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.9	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.12	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.08	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30121	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.09	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.9.20077	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.006.30119	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.16.20039	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.6	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.17.20053	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.05	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.11	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	ne	version:	15.6.30243	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.7	Trust: 0.3

sources: ZDI: ZDI-16-543 // BID: 93496 // JVNDB: JVNDB-2016-005283 // CNNVD: CNNVD-201610-378 // NVD: CVE-2016-6977

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-6977
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2016-6977
value:	CRITICAL
Trust: 0.8
ZDI:	CVE-2016-6977
value:	MEDIUM
Trust: 0.7
CNNVD:	CNNVD-201610-378
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-95797
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-6977
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
ZDI:	CVE-2016-6977
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.7
VULHUB:	VHN-95797
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-6977
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: ZDI: ZDI-16-543 // VULHUB: VHN-95797 // JVNDB: JVNDB-2016-005283 // CNNVD: CNNVD-201610-378 // NVD: CVE-2016-6977

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-95797 // JVNDB: JVNDB-2016-005283 // NVD: CVE-2016-6977

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-378

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201610-378

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-005283

PATCH

title:	APSB16-33	url:	https://helpx.adobe.com/security/products/acrobat/apsb16-33.html	Trust: 1.5
title:	APSB16-33	url:	https://helpx.adobe.com/jp/security/products/acrobat/apsb16-33.html	Trust: 0.8
title:	アドビシステムズ社 Adobe Reader の脆弱性に関するお知らせ	url:	http://www.fmworld.net/biz/common/adobe/20161013.html	Trust: 0.8
title:	Adobe Reader and Acrobat Repair measures for memory corruption vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64754	Trust: 0.6

sources: ZDI: ZDI-16-543 // JVNDB: JVNDB-2016-005283 // CNNVD: CNNVD-201610-378

EXTERNAL IDS

db:	NVD	id:	CVE-2016-6977	Trust: 3.5
db:	BID	id:	93496	Trust: 1.4
db:	SECTRACK	id:	1036986	Trust: 1.1
db:	ZDI	id:	ZDI-16-543	Trust: 1.0
db:	JVNDB	id:	JVNDB-2016-005283	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-3945	Trust: 0.7
db:	CNNVD	id:	CNNVD-201610-378	Trust: 0.7
db:	ZDI	id:	ZDI-16-542	Trust: 0.3
db:	ZDI	id:	ZDI-16-565	Trust: 0.3
db:	ZDI	id:	ZDI-16-541	Trust: 0.3
db:	ZDI	id:	ZDI-16-573	Trust: 0.3
db:	ZDI	id:	ZDI-16-564	Trust: 0.3
db:	ZDI	id:	ZDI-16-538	Trust: 0.3
db:	ZDI	id:	ZDI-16-553	Trust: 0.3
db:	ZDI	id:	ZDI-16-557	Trust: 0.3
db:	ZDI	id:	ZDI-16-562	Trust: 0.3
db:	ZDI	id:	ZDI-16-540	Trust: 0.3
db:	ZDI	id:	ZDI-16-566	Trust: 0.3
db:	ZDI	id:	ZDI-16-550	Trust: 0.3
db:	ZDI	id:	ZDI-16-555	Trust: 0.3
db:	ZDI	id:	ZDI-16-567	Trust: 0.3
db:	ZDI	id:	ZDI-16-558	Trust: 0.3
db:	ZDI	id:	ZDI-16-539	Trust: 0.3
db:	VULHUB	id:	VHN-95797	Trust: 0.1

sources: ZDI: ZDI-16-543 // VULHUB: VHN-95797 // BID: 93496 // JVNDB: JVNDB-2016-005283 // CNNVD: CNNVD-201610-378 // NVD: CVE-2016-6977

REFERENCES

url:	https://helpx.adobe.com/security/products/acrobat/apsb16-33.html	Trust: 2.4
url:	http://www.securityfocus.com/bid/93496	Trust: 1.1
url:	http://www.securitytracker.com/id/1036986	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6977	Trust: 0.8
url:	http://www.ipa.go.jp/security/ciadr/vul/20161012-adobereader.html	Trust: 0.8
url:	http://www.jpcert.or.jp/at/2016/at160041.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6977	Trust: 0.8
url:	http://www.adobe.com/products/flash/	Trust: 0.3
url:	http://www.adobe.com	Trust: 0.3
url:	https://helpx.adobe.com/security/products/acrobat/apsb16-33.html	Trust: 0.3
url:	www.zerodayinitiative.com/advisories/zdi-16-538/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-539/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-540/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-541/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-542/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-543/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-550/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-553/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-555/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-557/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-558/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-562/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-564/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-565/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-566/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-567/	Trust: 0.3
url:	http://www.zerodayinitiative.com/advisories/zdi-16-573/	Trust: 0.3

sources: ZDI: ZDI-16-543 // VULHUB: VHN-95797 // BID: 93496 // JVNDB: JVNDB-2016-005283 // CNNVD: CNNVD-201610-378 // NVD: CVE-2016-6977

CREDITS

Anonymous

Trust: 0.7

sources: ZDI: ZDI-16-543

SOURCES

db:	ZDI	id:	ZDI-16-543
db:	VULHUB	id:	VHN-95797
db:	BID	id:	93496
db:	JVNDB	id:	JVNDB-2016-005283
db:	CNNVD	id:	CNNVD-201610-378
db:	NVD	id:	CVE-2016-6977

LAST UPDATE DATE

2025-04-13T23:02:08.997000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-16-543	date:	2016-10-11T00:00:00
db:	VULHUB	id:	VHN-95797	date:	2017-07-30T00:00:00
db:	BID	id:	93496	date:	2016-11-24T01:07:00
db:	JVNDB	id:	JVNDB-2016-005283	date:	2016-10-17T00:00:00
db:	CNNVD	id:	CNNVD-201610-378	date:	2016-10-14T00:00:00
db:	NVD	id:	CVE-2016-6977	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-16-543	date:	2016-10-11T00:00:00
db:	VULHUB	id:	VHN-95797	date:	2016-10-13T00:00:00
db:	BID	id:	93496	date:	2016-10-11T00:00:00
db:	JVNDB	id:	JVNDB-2016-005283	date:	2016-10-17T00:00:00
db:	CNNVD	id:	CNNVD-201610-378	date:	2016-10-14T00:00:00
db:	NVD	id:	CVE-2016-6977	date:	2016-10-13T19:59:49.810