CVSS: 8.8EPSS: 4%CPEs: 38EXPL: 0CVE-2016-0943 – Adobe Reader DC Global Javascript API Restrictions Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2016-0943
Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X mishandle the Global object, which allows attackers to bypass JavaScript API execution restrictions via unspecified vectors. Adobe Reader y Acrobat en versiones anteriores a 11.0.14, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30119 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20056 en Windows y OS X no maneja adecuadamente el objeto Global, lo que permite a atacantes eludir las restricciones de ejecución de la API JavaScript a través de vectores no especificados. This vulnerability allows remote attackers to bypass API restrictions on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Global object. By creating a specially crafted PDF with specific JavaScript instructions, it is possible to bypass the JavaScript API restrictions. • http://www.securitytracker.com/id/1034646 http://zerodayinitiative.com/advisories/ZDI-16-012 https://helpx.adobe.com/security/products/acrobat/apsb16-02.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 5%CPEs: 38EXPL: 0CVE-2016-0935 – Adobe Reader Graphics State Parameter Dictionary Double Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0935
Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted ExtGState dictionary. Vulnerabilidad de liberación doble en Adobe Reader y Acrobat en versiones anteriores a 11.0.14, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30119 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20056 en Windows y OS X permite a atacantes ejecutar código arbitrario a través de un diccionario ExtGState manipulado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the ExtGState dictionary within PDFs. The issue lies in the processing of malformed dictionaries leading to a double free. • http://www.securitytracker.com/id/1034646 http://zerodayinitiative.com/advisories/ZDI-16-017 https://helpx.adobe.com/security/products/acrobat/apsb16-02.html •
CVSS: 9.3EPSS: 3%CPEs: 38EXPL: 0CVE-2016-0938 – Adobe Reader DC Forms Out-Of-Bounds Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0938
The AcroForm plugin in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946. El plugin AcroForm en Adobe Reader y Acrobat en versiones anteriores a 11.0.14, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30119 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20056 en Windows y OS X permite a atacantes ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945 y CVE-2016-0946. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AcroForm plugin. A specially crafted PDF file can force Adobe Reader DC to read memory past the end of an allocated object. • http://www.securitytracker.com/id/1034646 http://zerodayinitiative.com/advisories/ZDI-16-013 https://helpx.adobe.com/security/products/acrobat/apsb16-02.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 17%CPEs: 38EXPL: 0CVE-2016-0932 – Adobe Acrobat Reader DC Doc Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0932
Use-after-free vulnerability in the Doc object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0934, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941. Vulnerabilidad de uso después de liberación de memoria en la implementación del objeto Doc en Adobe Reader y Acrobat en versiones anteriores a 11.0.14, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30119 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20056 en Windows y OS X permite a atacantes ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-0934, CVE-2016-0937, CVE-2016-0940 y CVE-2016-0941. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Doc object. A specially crafted PDF document can force a dangling pointer to be reused after it has been freed. • http://www.securitytracker.com/id/1034646 http://zerodayinitiative.com/advisories/ZDI-16-008 https://helpx.adobe.com/security/products/acrobat/apsb16-02.html •
CVSS: 8.8EPSS: 17%CPEs: 38EXPL: 0CVE-2016-0941 – Adobe Acrobat Reader DC Search Query Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-0941
Use-after-free vulnerability in the Search object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0940. Vulnerabilidad de uso después de liberación de memoria en la implementación del objeto Search en Adobe Reader y Acrobat en versiones anteriores a 11.0.14, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30119 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.010.20056 en Windows y OS X permite a atacantes ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-0932, CVE-2016-0934, CVE-2016-0937 y CVE-2016-0940. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Search object. By calling the query method while Adobe Acrobat Reader DC is saving a global variable, an attacker can force a dangling pointer to be reused after it has been freed. • http://www.securitytracker.com/id/1034646 http://zerodayinitiative.com/advisories/ZDI-16-010 https://helpx.adobe.com/security/products/acrobat/apsb16-02.html •