PT-2016-1891 · Adobe · Acrobat+3

Kdot · Published 2016-01-07 · Updated 2018-10-30 · CVE-2016-1111

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Reader versions prior to 11.0.14 Adobe Acrobat and Acrobat Reader DC Classic versions prior to 15.006.30119 Adobe Acrobat and Acrobat Reader DC Continuous versions prior to 15.010.20056

Description A double free vulnerability in Adobe Reader and Acrobat allows attackers to execute arbitrary code via a crafted Graphics State dictionary. This issue can be exploited by a remote attacker to execute code. The vulnerability is related to the repeated freeing of memory, which can be triggered by a specially formed Graphics State dictionary.

Recommendations For Adobe Reader versions prior to 11.0.14, update to version 11.0.14 or later. For Adobe Acrobat and Acrobat Reader DC Classic versions prior to 15.006.30119, update to version 15.006.30119 or later. For Adobe Acrobat and Acrobat Reader DC Continuous versions prior to 15.010.20056, update to version 15.010.20056 or later. As a temporary workaround, consider restricting the use of the Graphics State dictionary until a patch is available.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2016-01224

CVE-2016-1111

ZDI-16-273

Affected Products

Acrobat Reader Dc Classic

Acrobat Reader Dc Continuous

Acrobat

Reader

References · 7

• https://helpx.adobe.com/security/products/acrobat/apsb16-02.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01224 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-273 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1111 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1111 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-16-273 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1111 · Note