PT-2016-1953 · Adobe · Acrobat+1

Published 2016-05-05 · Updated 2016-12-02 · CVE-2016-4106

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Reader versions (affected versions not specified) Adobe Acrobat versions (affected versions not specified)

Description The issue is related to the use of an insecure search path in Adobe Reader and Adobe Acrobat. This could allow a local attacker to elevate privileges by using a Trojan file in an uninstalled directory. The vulnerability enables attackers to execute code.

Recommendations For Adobe Reader, consider restricting access to uninstalled directories to minimize the risk of exploitation. For Adobe Acrobat, avoid using unverified resources until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2016-01286

CVE-2016-4106

Affected Products

Acrobat

Reader

References · 7

• https://bdu.fstec.ru/vul/2016-01286 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4106 · Vendor Advisory
• https://helpx.adobe.com/security/products/acrobat/apsb16-14.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4106 · Security Note
• http://securitytracker.com/id/1035828 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4106 · Note
• http://securityfocus.com/bid/90513 · Note