Sign-up

ID

VAR-201610-0641


CVE

CVE-2016-6939


TITLE

Windows and Mac OS X Run on Adobe Reader and Acrobat Heap-based buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2016-005321

DESCRIPTION

Heap-based buffer overflow in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-6994. This vulnerability CVE-2016-6994 Is a different vulnerability.An attacker could execute arbitrary code. Failed attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF

Trust: 1.98

sources: NVD: CVE-2016-6939 // JVNDB: JVNDB-2016-005321 // BID: 93487 // VULHUB: VHN-95759

AFFECTED PRODUCTS

vendor:adobemodel:readerscope:lteversion:11.0.17

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.017.20053

Trust: 1.0

vendor:adobemodel:acrobat dcscope:lteversion:15.006.30201

Trust: 1.0

vendor:adobemodel:acrobatscope:lteversion:11.0.17

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.017.20053

Trust: 1.0

vendor:adobemodel:acrobat reader dcscope:lteversion:15.006.30201

Trust: 1.0

vendor:adobemodel:acrobatscope:ltversion:xi desktop 11.0.18 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:classic 15.006.30243 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat dcscope:ltversion:continuous track 15.020.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:classic 15.006.30243 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:acrobat reader dcscope:ltversion:continuous track 15.020.20039 (windows/macintosh)

Trust: 0.8

vendor:adobemodel:readerscope:ltversion:xi desktop 11.0.18 (windows/macintosh)

Trust: 0.8

vendor:microsoftmodel:windowsscope: - version: -

Trust: 0.6

vendor:adobemodel:acrobatscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.20.20039

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30201

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.17.20053

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:neversion:15.6.30243

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30097

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.4

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.10

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.14

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.1

Trust: 0.3

vendor:adobemodel:readerscope:neversion:11.0.18

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.6.30201

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20059

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.16

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.17

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.20.20039

Trust: 0.3

vendor:adobemodel:acrobatscope:neversion:11.0.18

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30172

Trust: 0.3

vendor:adobemodel:acrobat reader dcscope:eqversion:15.10.20060

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.2

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.15

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.010.20056

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.7

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.17

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.13

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.9

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.12

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.08

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.6.30121

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.09

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.9.20077

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.006.30119

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.16.20039

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.6

Trust: 0.3

vendor:adobemodel:acrobat dcscope:eqversion:15.17.20053

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.05

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.11

Trust: 0.3

vendor:adobemodel:acrobat dcscope:neversion:15.6.30243

Trust: 0.3

vendor:adobemodel:readerscope:eqversion:11.0.3

Trust: 0.3

vendor:adobemodel:acrobatscope:eqversion:11.0.7

Trust: 0.3

sources: BID: 93487 // JVNDB: JVNDB-2016-005321 // CNNVD: CNNVD-201610-338 // NVD: CVE-2016-6939

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6939
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-6939
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201610-338
value: CRITICAL

Trust: 0.6

VULHUB: VHN-95759
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-6939
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-95759
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6939
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-95759 // JVNDB: JVNDB-2016-005321 // CNNVD: CNNVD-201610-338 // NVD: CVE-2016-6939

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-95759 // JVNDB: JVNDB-2016-005321 // NVD: CVE-2016-6939

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-338

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201610-338

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-005321

PATCH
title:APSB16-33url:https://helpx.adobe.com/security/products/acrobat/apsb16-33.html
Trust: 0.8
title:APSB16-33url:https://helpx.adobe.com/jp/security/products/acrobat/apsb16-33.html
Trust: 0.8
title:アドビ システムズ社 Adobe Reader の脆弱性に関するお知らせurl:http://www.fmworld.net/biz/common/adobe/20161013.html
Trust: 0.8
title:Adobe Acrobat  and Reader Fixes for heap-based buffer overflow vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64715
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2016-005321 // 
            
            
            
            CNNVD: CNNVD-201610-338

EXTERNAL IDS
db:NVDid:CVE-2016-6939
Trust: 2.8
db:BIDid:93487
Trust: 2.0
db:SECTRACKid:1036986
Trust: 1.1
db:JVNDBid:JVNDB-2016-005321
Trust: 0.8
db:CNNVDid:CNNVD-201610-338
Trust: 0.6
db:VULHUBid:VHN-95759
Trust: 0.1
sources:
            
            
            VULHUB: VHN-95759 // 
            
            
            
            BID: 93487 // 
            
            
            
            JVNDB: JVNDB-2016-005321 // 
            
            
            
            CNNVD: CNNVD-201610-338 // 
            
            
            
            NVD: CVE-2016-6939

REFERENCES
url:http://www.securityfocus.com/bid/93487
Trust: 1.7
url:https://helpx.adobe.com/security/products/acrobat/apsb16-33.html
Trust: 1.7
url:http://www.securitytracker.com/id/1036986
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6939
Trust: 0.8
url:http://www.ipa.go.jp/security/ciadr/vul/20161012-adobereader.html
Trust: 0.8
url:http://www.jpcert.or.jp/at/2016/at160041.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6939
Trust: 0.8
url:http://www.adobe.com/products/flash/
Trust: 0.3
url:http://www.adobe.com
Trust: 0.3
url:https://helpx.adobe.com/security/products/acrobat/apsb16-33.html 
Trust: 0.3
sources:
            
            
            VULHUB: VHN-95759 // 
            
            
            
            BID: 93487 // 
            
            
            
            JVNDB: JVNDB-2016-005321 // 
            
            
            
            CNNVD: CNNVD-201610-338 // 
            
            
            
            NVD: CVE-2016-6939

CREDITS
Kai Lu of Fortinet's FortiGuard Labs and Ke Liu of Tencent's Xuanwu LAB
Trust: 0.9
sources:
            
            
            BID: 93487 // 
            
            
            
            CNNVD: CNNVD-201610-338

SOURCES
db:VULHUBid:VHN-95759
db:BIDid:93487
db:JVNDBid:JVNDB-2016-005321
db:CNNVDid:CNNVD-201610-338
db:NVDid:CVE-2016-6939

LAST UPDATE DATE
2025-04-13T23:02:03.697000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-95759date:2017-07-30T00:00:00
db:BIDid:93487date:2016-10-26T11:03:00
db:JVNDBid:JVNDB-2016-005321date:2016-10-18T00:00:00
db:CNNVDid:CNNVD-201610-338date:2016-10-14T00:00:00
db:NVDid:CVE-2016-6939date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-95759date:2016-10-13T00:00:00
db:BIDid:93487date:2016-10-11T00:00:00
db:JVNDBid:JVNDB-2016-005321date:2016-10-18T00:00:00
db:CNNVDid:CNNVD-201610-338date:2016-10-13T00:00:00
db:NVDid:CVE-2016-6939date:2016-10-13T19:59:07.467