CVE-2016-1079

Adobe Reader y Acrobat en versiones anteriores a 11.0.16, Acrobat y Acrobat Reader DC Classic en versiones anteriores a 15.006.30172 y Acrobat y Acrobat Reader DC Continuous en versiones anteriores a 15.016.20039 sobre Windows y OS X permiten a atacantes obtener información sensible de la memoria de proceso a través de vectores no especificados, una vulnerabilidad diferente a CVE-2016-1092.

This vulnerability allows an attacker to leak sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the app.removeToolButton method. By calling app.removeToolButton multiple times, it is possible to force Acrobat Pro DC to leak heap addresses. An attacker can use this information in conjunction with other vulnerabilities to execute code in the context of the process.