Vulnerability-Lookup

CNVD-2016-02929

Vulnerability from cnvd - Published: 2016-05-11

Title

多款Adobe产品内存错误引用漏洞（CNVD-2016-02929）

Description

Adobe Reader等都是美国奥多比（Adobe）公司的产品。Adobe Reader是一款免费的PDF文件阅读器；Acrobat是一款PDF文件编辑和转换工具；Acrobat Reader DC是一套用于查看、打印和批注PDF的工具。Classic和Continuous是Acrobat Reader DC产品下载中心所提供的两种更新机制。Adobe Download Manager是一套支持自动从Adobe服务器下载安装程序的工具。多款Adobe产品中存在内存错误引用漏洞。攻击者可借助特制的Graphics State目录，利用该漏洞执行任意代码。

Severity

中

Patch Name

多款Adobe产品内存错误引用漏洞（CNVD-2016-02929）的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://helpx.adobe.com/security/products/acrobat/apsb16-02.html

Reference

https://helpx.adobe.com/security/products/acrobat/apsb16-02.html

Impacted products

Name
['Adobe Reader <11.0.14', 'Adobe Acrobat <11.0.14', 'Adobe Acrobat <15.006.30119', 'Adobe Acrobat Reader DC Classic <15.006.30119', 'Adobe Acrobat(on Windows/OS X ) <15.010.20056', 'Adobe Acrobat Reader DC Continuous(on WindowsOS X) <15.010.20056']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-1111"
    }
  },
  "description": "Adobe Reader\u7b49\u90fd\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Adobe Reader\u662f\u4e00\u6b3e\u514d\u8d39\u7684PDF\u6587\u4ef6\u9605\u8bfb\u5668\uff1bAcrobat\u662f\u4e00\u6b3ePDF\u6587\u4ef6\u7f16\u8f91\u548c\u8f6c\u6362\u5de5\u5177\uff1bAcrobat Reader DC\u662f\u4e00\u5957\u7528\u4e8e\u67e5\u770b\u3001\u6253\u5370\u548c\u6279\u6ce8PDF\u7684\u5de5\u5177\u3002Classic\u548cContinuous\u662fAcrobat Reader DC\u4ea7\u54c1\u4e0b\u8f7d\u4e2d\u5fc3\u6240\u63d0\u4f9b\u7684\u4e24\u79cd\u66f4\u65b0\u673a\u5236\u3002Adobe Download Manager\u662f\u4e00\u5957\u652f\u6301\u81ea\u52a8\u4eceAdobe\u670d\u52a1\u5668\u4e0b\u8f7d\u5b89\u88c5\u7a0b\u5e8f\u7684\u5de5\u5177\u3002\r\n\r\n\u591a\u6b3eAdobe\u4ea7\u54c1\u4e2d\u5b58\u5728\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684Graphics State\u76ee\u5f55\uff0c\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "kdot, working with HPE\u0027s Zero Day Initiative",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://helpx.adobe.com/security/products/acrobat/apsb16-02.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-02929",
  "openTime": "2016-05-11",
  "patchDescription": "Adobe Reader\u7b49\u90fd\u662f\u7f8e\u56fd\u5965\u591a\u6bd4\uff08Adobe\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Adobe Reader\u662f\u4e00\u6b3e\u514d\u8d39\u7684PDF\u6587\u4ef6\u9605\u8bfb\u5668\uff1bAcrobat\u662f\u4e00\u6b3ePDF\u6587\u4ef6\u7f16\u8f91\u548c\u8f6c\u6362\u5de5\u5177\uff1bAcrobat Reader DC\u662f\u4e00\u5957\u7528\u4e8e\u67e5\u770b\u3001\u6253\u5370\u548c\u6279\u6ce8PDF\u7684\u5de5\u5177\u3002Classic\u548cContinuous\u662fAcrobat Reader DC\u4ea7\u54c1\u4e0b\u8f7d\u4e2d\u5fc3\u6240\u63d0\u4f9b\u7684\u4e24\u79cd\u66f4\u65b0\u673a\u5236\u3002Adobe Download Manager\u662f\u4e00\u5957\u652f\u6301\u81ea\u52a8\u4eceAdobe\u670d\u52a1\u5668\u4e0b\u8f7d\u5b89\u88c5\u7a0b\u5e8f\u7684\u5de5\u5177\u3002\r\n\r\n\u591a\u6b3eAdobe\u4ea7\u54c1\u4e2d\u5b58\u5728\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684Graphics State\u76ee\u5f55\uff0c\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eAdobe\u4ea7\u54c1\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\uff08CNVD-2016-02929\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Adobe Reader \u003c11.0.14",
      "Adobe Acrobat \u003c11.0.14",
      "Adobe Acrobat \u003c15.006.30119",
      "Adobe Acrobat Reader DC Classic \u003c15.006.30119",
      "Adobe Acrobat(on Windows/OS X ) \u003c15.010.20056",
      "Adobe Acrobat Reader DC Continuous(on WindowsOS X) \u003c15.010.20056"
    ]
  },
  "referenceLink": "https://helpx.adobe.com/security/products/acrobat/apsb16-02.html",
  "serverity": "\u4e2d",
  "submitTime": "2016-05-04",
  "title": "\u591a\u6b3eAdobe\u4ea7\u54c1\u5185\u5b58\u9519\u8bef\u5f15\u7528\u6f0f\u6d1e\uff08CNVD-2016-02929\uff09"
}

CVE-2016-1111 (GCVE-0-2016-1111)

Vulnerability from cvelistv5 – Published: 2016-04-30 10:00 – Updated: 2024-08-05 22:48

Summary

Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary.

Severity

No CVSS data available.

CWE

Assigner

adobe

References

2 references

URL	Tags
https://helpx.adobe.com/security/products/acrobat…	x_refsource_CONFIRM
http://www.zerodayinitiative.com/advisories/ZDI-16-273/	x_refsource_MISC

Date Public

2016-04-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:48:12.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/acrobat/apsb16-02.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-16-273/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-04-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-04-30T01:57:01.000Z",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://helpx.adobe.com/security/products/acrobat/apsb16-02.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-16-273/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2016-1111",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://helpx.adobe.com/security/products/acrobat/apsb16-02.html",
              "refsource": "CONFIRM",
              "url": "https://helpx.adobe.com/security/products/acrobat/apsb16-02.html"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-16-273/",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-16-273/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2016-1111",
    "datePublished": "2016-04-30T10:00:00.000Z",
    "dateReserved": "2015-12-22T00:00:00.000Z",
    "dateUpdated": "2024-08-05T22:48:12.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-02929

CVE-2016-1111 (GCVE-0-2016-1111)

Tags

Sightings

Nomenclature