PT-2016-1979 · Adobe · Acrobat+1

Published 2016-05-05 · Updated 2016-12-01 · CVE-2016-1087

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Reader versions (affected versions not specified) Adobe Acrobat versions (affected versions not specified)

Description The issue is related to the use of an insecure search path in Adobe Reader and Adobe Acrobat. This could allow a local attacker to elevate privileges by using a Trojan file in an uninstalled directory. The vulnerability enables attackers to execute code.

Recommendations For Adobe Reader, consider restricting access to uninstalled directories to minimize the risk of exploitation. For Adobe Acrobat, avoid using untrusted files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2016-01312

CVE-2016-1087

Affected Products

Acrobat

Reader

References · 7

• https://helpx.adobe.com/security/products/acrobat/apsb16-14.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01312 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1087 · Security Note
• http://securitytracker.com/id/1035828 · Note
• http://securityfocus.com/bid/90513 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1087 · Note