Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1009.

The version of Adobe Reader installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption issue exists due to the use of     uninitialized memory when handling annotation gestures.
    A remote attacker can exploit this, via a crafted PDF     file, to corrupt memory, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-1007)

  - A flaw exists related to searching and loading     dynamic-link library (DLL) files due to using a search     path that may contain directories which are not trusted     or under the user's control. An attacker can exploit     this, by injecting a malicious DLL into the path, to     gain elevated privileges. (CVE-2016-1008)

  - An array indexing error exists due to improper     validation of user-supplied input. A remote attacker can     exploit this, via a crafted PDF file, to corrupt memory,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2016-1009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption issue exists due to the use of     uninitialized memory when handling annotation gestures.
    A remote attacker can exploit this, via a crafted PDF     file, to corrupt memory, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-1007)

  - A flaw exists related to searching and loading     dynamic-link library (DLL) files due to using a search     path that may contain directories which are not trusted     or under the user's control. An attacker can exploit     this, by injecting a malicious DLL into the path, to     gain elevated privileges. (CVE-2016-1008)

  - An array indexing error exists due to improper     validation of user-supplied input. A remote attacker can     exploit this, via a crafted PDF file, to corrupt memory,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2016-1009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote Windows host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption issue exists due to the use of     uninitialized memory when handling annotation gestures.
    A remote attacker can exploit this, via a crafted PDF     file, to corrupt memory, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-1007)

  - A flaw exists related to searching and loading     dynamic-link library (DLL) files due to using a search     path that may contain directories which are not trusted     or under the user's control. An attacker can exploit     this, by injecting a malicious DLL into the path, to     gain elevated privileges. (CVE-2016-1008)

  - An array indexing error exists due to improper     validation of user-supplied input. A remote attacker can     exploit this, via a crafted PDF file, to corrupt memory,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2016-1009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote Windows host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities :

  - A memory corruption issue exists due to the use of     uninitialized memory when handling annotation gestures.
    A remote attacker can exploit this, via a crafted PDF     file, to corrupt memory, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-1007)

  - A flaw exists related to searching and loading     dynamic-link library (DLL) files due to using a search     path that may contain directories which are not trusted     or under the user's control. An attacker can exploit     this, by injecting a malicious DLL into the path, to     gain elevated privileges. (CVE-2016-1008)

  - An array indexing error exists due to improper     validation of user-supplied input. A remote attacker can     exploit this, via a crafted PDF file, to corrupt memory,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2016-1009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
89833	Adobe Reader < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
89832	Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
89831	Adobe Reader < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09)	Nessus	Windows	critical
89830	Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09)	Nessus	Windows	critical

Detections

Analytics

CVE-2016-1007

critical

Tenable Plugins

critical

critical

critical

critical