CVE-2016-4119
published 2016-08-26CVE-2016-4119: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before…
PriorityP269critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
3.96%
89.3th percentile
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | acrobat | <= 11.0.16 | — |
| adobe | acrobat_dc | <= 15.006.30174 | — |
| adobe | acrobat_dc | <= 15.016.20045 | — |
| adobe | acrobat_reader_dc | <= 15.006.30174 | — |
| adobe | acrobat_reader_dc | <= 15.016.20045 | — |
| adobe | reader | <= 11.0.16 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Crash occurs in AcroRd32.exe at AcroRd32_60000000!CTJPEGDecoderReadNextTile+0x24661 (address 6021d2e1) with access violation (code c0000005) when processing a specially crafted PDF with a corrupted deflate-compressed image stream in an object. ↗
- →The vulnerability is triggered by a single-byte modification at offset 0x25B0C within obj 29 of the PDF, which stores a deflate-compressed image (width 405/0x195, height 134/0x86), causing a use-after-free when the corrupted stream is parsed. ↗
- →The freed heap buffer (size 0xfe0c) is accessed via ECX (derived from ESI+0xC8), where ECX points to an already-freed allocation. Detection can focus on heap use-after-free patterns in AcroRd32 involving CTJPEGDecoderReadNextTile and BIB/AGM module call chains. ↗
- →Heap spray pattern: freed/reallocated heap buffers are filled with 0xc0c0c0c0, which can serve as a memory pattern indicator during exploit attempts against this vulnerability. ↗
- →The decompressed image data in the PoC PDF contains the ASCII string 'AGLOSUVVVUTRNID=' which can be used as a memory or file-content search signature to identify the malicious PDF. ↗
- ·Affected versions are Adobe Reader/Acrobat before 11.0.16, Acrobat/Reader DC Classic before 15.006.30172, and Acrobat/Reader DC Continuous before 15.016.20039 on Windows and OS X. ↗
- ·The crash and use-after-free analysis was performed on Adobe Reader DC (32-bit, AcroRd32.exe) with Page Heap (verifier) enabled; crash addresses and offsets may differ across builds or with ASLR. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5h6w-9ggg-x966: Adobe Reader and Acrobat before 11
ghsa_unreviewed·2022-05-17·CVSS 9.8
CVE-2016-4119 [CRITICAL] CWE-119 GHSA-5h6w-9ggg-x966: Adobe Reader and Acrobat before 11
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE
VulnCheck
Apple MacOS X Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2016·CVSS 9.8
CVE-2016-4119 [CRITICAL] Apple MacOS X Improper Restriction of Operations within the Bounds of a Memory Buffer
Apple MacOS X Improper Restriction of Operations within the Bounds of a Memory Buffer
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-20
No detection rules found.
No public exploits indexed.
Fortinet
Looking Back at Fortinet’s Security Research and Vulnerability Discoveries
blogs_fortinet·2017-02-21
Looking Back at Fortinet’s Security Research and Vulnerability Discoveries
FORTIGUARD LABS THREAT RESEARCH
Looking Back at Fortinet’s Security Research and Vulnerability Discoveries
By Peixue Li | February 21, 2017
In an effort to provide more proactive protections in Fortinet products and to more effectively identify and defeat network threats, the Fortinet security research team works on discovering potential threats in popular products. As a result, over the past year we have discovered 84 vulnerabilities that have been reported to their respective vendors as part of our responsible vulnerability disclosure process. Fortinet protections against these discoveries were released to Fortinet products at the same time these vulnerabilities were reported to their vendors. As a result, Fortinet products have been able to proactively protect Fortinet customers’ netw
Fortinet
Analysis of Use-After-Free Vulnerability (CVE-2016-4119) in Adobe Acrobat and Reader
blogs_fortinet·2016-06-06·CVSS 9.8
CVE-2016-4119 [CRITICAL] Analysis of Use-After-Free Vulnerability (CVE-2016-4119) in Adobe Acrobat and Reader
FORTIGUARD LABS THREAT RESEARCH
Analysis of Use-After-Free Vulnerability (CVE-2016-4119) in Adobe Acrobat and Reader
By Kai Lu and Kushal Arvind Shah | June 06, 2016
Summary
Recently, Adobe patched some security vulnerabilities in Adobe Acrobat and Reader. One of them is a use-after-free vulnerability (CVE-2016-4119) discovered by Fortinet's FortiGuard Labs. In this blog, we want to share our analysis of this vulnerability.
Proof of Concept
This vulnerability can be reproduced by opening the PDF file “PoC_decrypt.pdf” with Adobe Reader DC. When opened, AcroRd32.exe crashes, and the crash information shows the following:
(28d8.110): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and hand
https://blog.fortinet.com/2016/06/06/analysis-of-use-after-free-vulnerability-cve-2016-4119-in-adobe-acrobat-and-readerhttps://helpx.adobe.com/security/products/acrobat/apsb16-14.htmlhttps://blog.fortinet.com/2016/06/06/analysis-of-use-after-free-vulnerability-cve-2016-4119-in-adobe-acrobat-and-readerhttps://helpx.adobe.com/security/products/acrobat/apsb16-14.html
2016-08-26
Published
Exploited in the wild