Details of VAR-201610-0479

ID

VAR-201610-0479

CVE

CVE-2016-6957

TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat In JavaScript API Vulnerability that circumvents execution restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2016-005303

DESCRIPTION

Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-254: Security Features ( Security function ) Has been identified. http://cwe.mitre.org/data/definitions/254.htmlBy the attacker, JavaScript API Execution restrictions may be avoided. Adobe Acrobat and Reader are prone to a security-bypass vulnerability. Successfully exploiting this issue will allow attackers to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Trust: 2.07

sources: NVD: CVE-2016-6957 // JVNDB: JVNDB-2016-005303 // BID: 93486 // VULHUB: VHN-95777 // VULMON: CVE-2016-6957

AFFECTED PRODUCTS

vendor:	adobe	model:	reader	scope:	lte	version:	11.0.17	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	lte	version:	15.017.20053	Trust: 1.0
vendor:	adobe	model:	acrobat dc	scope:	lte	version:	15.006.30201	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	lte	version:	11.0.17	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	lte	version:	15.017.20053	Trust: 1.0
vendor:	adobe	model:	acrobat reader dc	scope:	lte	version:	15.006.30201	Trust: 1.0
vendor:	adobe	model:	acrobat	scope:	lt	version:	xi desktop 11.0.18 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	classic 15.006.30243 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat dc	scope:	lt	version:	continuous track 15.020.20039 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	classic 15.006.30243 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	acrobat reader dc	scope:	lt	version:	continuous track 15.020.20039 (windows/macintosh)	Trust: 0.8
vendor:	adobe	model:	reader	scope:	lt	version:	xi desktop 11.0.18 (windows/macintosh)	Trust: 0.8
vendor:	apple	model:	mac os x	scope:	-	version:	-	Trust: 0.6
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30174	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.13	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.6	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.09	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30097	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	ne	version:	15.20.20039	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30172	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30201	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30121	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.10	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.4	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.14	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.006.30119	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30198	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.1	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	ne	version:	15.6.30243	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30097	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.16	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.4	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.10	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.14	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.1	Trust: 0.3
vendor:	adobe	model:	reader	scope:	ne	version:	11.0.18	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30201	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.12	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.15	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.08	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30174	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.16	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.17	Trust: 0.3
vendor:	adobe	model:	acrobat reader dc	scope:	eq	version:	15.6.30198	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	ne	version:	15.20.20039	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	ne	version:	11.0.18	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30172	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.2	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.15	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.12	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.11	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.9	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.7	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.17	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.13	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.08	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.6.30121	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.09	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	eq	version:	15.006.30119	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.6	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.11	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.05	Trust: 0.3
vendor:	adobe	model:	acrobat dc	scope:	ne	version:	15.6.30243	Trust: 0.3
vendor:	adobe	model:	reader	scope:	eq	version:	11.0.3	Trust: 0.3
vendor:	adobe	model:	acrobat	scope:	eq	version:	11.0.7	Trust: 0.3

sources: BID: 93486 // JVNDB: JVNDB-2016-005303 // CNNVD: CNNVD-201610-335 // NVD: CVE-2016-6957

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-6957
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2016-6957
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201610-335
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-95777
value:	HIGH
Trust: 0.1
VULMON:	CVE-2016-6957
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-6957
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-95777
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-6957
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-95777 // VULMON: CVE-2016-6957 // JVNDB: JVNDB-2016-005303 // CNNVD: CNNVD-201610-335 // NVD: CVE-2016-6957

PROBLEMTYPE DATA

problemtype:	CWE-254	Trust: 1.1
problemtype:	CWE-Other	Trust: 0.8

sources: VULHUB: VHN-95777 // JVNDB: JVNDB-2016-005303 // NVD: CVE-2016-6957

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-335

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201610-335

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-005303

PATCH

title:	APSB16-33	url:	https://helpx.adobe.com/security/products/acrobat/apsb16-33.html	Trust: 0.8
title:	APSB16-33	url:	https://helpx.adobe.com/jp/security/products/acrobat/apsb16-33.html	Trust: 0.8
title:	アドビシステムズ社 Adobe Reader の脆弱性に関するお知らせ	url:	http://www.fmworld.net/biz/common/adobe/20161013.html	Trust: 0.8
title:	Adobe Acrobat and Reader Repair measures for security bypass vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64711	Trust: 0.6
title:	BleepingComputer	url:	https://www.bleepingcomputer.com/news/security/adobe-releases-updates-that-resolve-84-security-vulnerabilities/	Trust: 0.1

sources: VULMON: CVE-2016-6957 // JVNDB: JVNDB-2016-005303 // CNNVD: CNNVD-201610-335

EXTERNAL IDS

db:	NVD	id:	CVE-2016-6957	Trust: 2.9
db:	BID	id:	93486	Trust: 2.1
db:	SECTRACK	id:	1036986	Trust: 1.2
db:	JVNDB	id:	JVNDB-2016-005303	Trust: 0.8
db:	CNNVD	id:	CNNVD-201610-335	Trust: 0.7
db:	VULHUB	id:	VHN-95777	Trust: 0.1
db:	VULMON	id:	CVE-2016-6957	Trust: 0.1

sources: VULHUB: VHN-95777 // VULMON: CVE-2016-6957 // BID: 93486 // JVNDB: JVNDB-2016-005303 // CNNVD: CNNVD-201610-335 // NVD: CVE-2016-6957

REFERENCES

url:	http://www.securityfocus.com/bid/93486	Trust: 1.8
url:	https://helpx.adobe.com/security/products/acrobat/apsb16-33.html	Trust: 1.8
url:	http://www.securitytracker.com/id/1036986	Trust: 1.2
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6957	Trust: 0.8
url:	http://www.ipa.go.jp/security/ciadr/vul/20161012-adobereader.html	Trust: 0.8
url:	http://www.jpcert.or.jp/at/2016/at160041.html	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6957	Trust: 0.8
url:	http://www.adobe.com/products/acrobat/	Trust: 0.3
url:	http://www.adobe.com	Trust: 0.3
url:	http://www.adobe.com/products/reader/	Trust: 0.3
url:	https://helpx.adobe.com/security/products/acrobat/apsb16-33.html	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/254.html	Trust: 0.1
url:	https://www.rapid7.com/db/vulnerabilities/acrobat-cve-2016-6957	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=49245	Trust: 0.1

sources: VULHUB: VHN-95777 // VULMON: CVE-2016-6957 // BID: 93486 // JVNDB: JVNDB-2016-005303 // CNNVD: CNNVD-201610-335 // NVD: CVE-2016-6957

CREDITS

Gal De Leon of Palo Alto Networks.

Trust: 0.9

sources: BID: 93486 // CNNVD: CNNVD-201610-335

SOURCES

db:	VULHUB	id:	VHN-95777
db:	VULMON	id:	CVE-2016-6957
db:	BID	id:	93486
db:	JVNDB	id:	JVNDB-2016-005303
db:	CNNVD	id:	CNNVD-201610-335
db:	NVD	id:	CVE-2016-6957

LAST UPDATE DATE

2025-04-13T23:02:04.804000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-95777	date:	2017-07-30T00:00:00
db:	VULMON	id:	CVE-2016-6957	date:	2017-07-30T00:00:00
db:	BID	id:	93486	date:	2016-10-26T02:03:00
db:	JVNDB	id:	JVNDB-2016-005303	date:	2016-10-17T00:00:00
db:	CNNVD	id:	CNNVD-201610-335	date:	2016-10-14T00:00:00
db:	NVD	id:	CVE-2016-6957	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-95777	date:	2016-10-13T00:00:00
db:	VULMON	id:	CVE-2016-6957	date:	2016-10-13T00:00:00
db:	BID	id:	93486	date:	2016-10-11T00:00:00
db:	JVNDB	id:	JVNDB-2016-005303	date:	2016-10-17T00:00:00
db:	CNNVD	id:	CNNVD-201610-335	date:	2016-10-13T00:00:00
db:	NVD	id:	CVE-2016-6957	date:	2016-10-13T19:59:28.027