Arbitrary code execution in Adobe Acrobat and Adobe Reader - CVE-2016-6967
Published: October 12, 2016 / Updated: October 12, 2016
Vulnerability identifier: #VU913
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6967
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated user to cause arbitrary code execution on the target system.
The weakness is due to use-after-free memory error. By tricking the victim to download a specially crafted file attackers can bypass security restrictions and trigger an arbitrary code to be executed.
Successful exploitatin of the vulnerability leads to arbitrary code execution on the vulnerable system.
The weakness is due to use-after-free memory error. By tricking the victim to download a specially crafted file attackers can bypass security restrictions and trigger an arbitrary code to be executed.
Successful exploitatin of the vulnerability leads to arbitrary code execution on the vulnerable system.
Affected software
Adobe Acrobat
Adobe Reader
Adobe Reader
How to mitigate CVE-2016-6967
Update Adobe Acrobat DC to version 15.020.20039.
Update Adobe Acrobat Reader DC to version 15.006.30243.
Update Adobe Reader IX and Adobe Acrobat IX to version 11.0.18.
Update Adobe Acrobat Reader DC to version 15.006.30243.
Update Adobe Reader IX and Adobe Acrobat IX to version 11.0.18.