Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, and CVE-2016-7019.

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 11.0.18, 15.006.30243, or 15.020.20039. It is, therefore, affected by multiple vulnerabilities.

  - Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and     Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to     execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a     different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947,     CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975,     CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998,     CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013,     CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7852,     and CVE-2016-7853. (CVE-2016-7854)

  - Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and     Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to     execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a     different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947,     CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975,     CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998,     CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013,     CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7852,     and CVE-2016-7854. (CVE-2016-7853)

  - Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and     Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to     execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a     different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947,     CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975,     CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998,     CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013,     CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7853,     and CVE-2016-7854. (CVE-2016-7852)

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC     Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability     than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952,     CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967,     CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
    (CVE-2016-1089)

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC     Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability     than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952,     CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967,     CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
    (CVE-2016-1091)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote macOS or Mac OS X host is prior to 11.0.18, 15.006.30243, or 15.020.20039. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-1089, CVE-2016-1091, CVE-2016-6944,     CVE-2016-6945, CVE-2016-6946, CVE-2016-6949,     CVE-2016-6952, CVE-2016-6953, CVE-2016-6961,     CVE-2016-6962, CVE-2016-6963, CVE-2016-6964,     CVE-2016-6965, CVE-2016-6967, CVE-2016-6968,     CVE-2016-6969, CVE-2016-6971, CVE-2016-6979,     CVE-2016-6988, CVE-2016-6993)

  - Multiple heap buffer overflow conditions exist that     allow an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2016-6939, CVE-2016-6994)

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-6940, CVE-2016-6941, CVE-2016-6942,     CVE-2016-6943, CVE-2016-6947, CVE-2016-6948,     CVE-2016-6950, CVE-2016-6951, CVE-2016-6954,     CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970,     CVE-2016-6972, CVE-2016-6973, CVE-2016-6974,     CVE-2016-6975, CVE-2016-6976, CVE-2016-6977,     CVE-2016-6978, CVE-2016-6995, CVE-2016-6996,     CVE-2016-6997, CVE-2016-6998, CVE-2016-7000,     CVE-2016-7001, CVE-2016-7002, CVE-2016-7003,     CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009,     CVE-2016-7010, CVE-2016-7011, CVE-2016-7012,     CVE-2016-7013, CVE-2016-7014, CVE-2016-7015,     CVE-2016-7016, CVE-2016-7017, CVE-2016-7018,     CVE-2016-7019)

  - A security bypass vulnerability exists that allows an     unauthenticated, remote attacker to bypass restrictions     on JavaScript API execution. (CVE-2016-6957)

  - An unspecified security bypass vulnerability exists that     allows an unauthenticated, remote attacker to bypass     security restrictions. (CVE-2016-6958)

  - An integer overflow condition exists that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-6999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Acrobat installed on the remote macOS Mac OS X host is prior to 11.0.18, 15.006.30243, or 15.020.20039. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-1089, CVE-2016-1091, CVE-2016-6944,     CVE-2016-6945, CVE-2016-6946, CVE-2016-6949,     CVE-2016-6952, CVE-2016-6953, CVE-2016-6961,     CVE-2016-6962, CVE-2016-6963, CVE-2016-6964,     CVE-2016-6965, CVE-2016-6967, CVE-2016-6968,     CVE-2016-6969, CVE-2016-6971, CVE-2016-6979,     CVE-2016-6988, CVE-2016-6993)

  - Multiple heap buffer overflow conditions exist that     allow an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2016-6939, CVE-2016-6994)

  - Multiple memory corruption issues exist that allow an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-6940, CVE-2016-6941, CVE-2016-6942,     CVE-2016-6943, CVE-2016-6947, CVE-2016-6948,     CVE-2016-6950, CVE-2016-6951, CVE-2016-6954,     CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970,     CVE-2016-6972, CVE-2016-6973, CVE-2016-6974,     CVE-2016-6975, CVE-2016-6976, CVE-2016-6977,     CVE-2016-6978, CVE-2016-6995, CVE-2016-6996,     CVE-2016-6997, CVE-2016-6998, CVE-2016-7000,     CVE-2016-7001, CVE-2016-7002, CVE-2016-7003,     CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009,     CVE-2016-7010, CVE-2016-7011, CVE-2016-7012,     CVE-2016-7013, CVE-2016-7014, CVE-2016-7015,     CVE-2016-7016, CVE-2016-7017, CVE-2016-7018,     CVE-2016-7019)

  - A security bypass vulnerability exists that allows an     unauthenticated, remote attacker to bypass restrictions     on JavaScript API execution. (CVE-2016-6957)

  - An unspecified security bypass vulnerability exists that     allows an unauthenticated, remote attacker to bypass     security restrictions. (CVE-2016-6958)

  - An integer overflow condition exists that allows an     unauthenticated, remote attacker to execute arbitrary     code. (CVE-2016-6999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe Reader installed on the remote Windows host is a version prior to 15.006.30243 or 15.020.20039. It is, therefore, affected by multiple vulnerabilities.

  - Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and     Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to     execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a     different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947,     CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975,     CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998,     CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013,     CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7852,     and CVE-2016-7853. (CVE-2016-7854)

  - Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and     Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to     execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a     different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947,     CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975,     CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998,     CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013,     CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7852,     and CVE-2016-7854. (CVE-2016-7853)

  - Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and     Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to     execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a     different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947,     CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959,     CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975,     CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998,     CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006,     CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013,     CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7853,     and CVE-2016-7854. (CVE-2016-7852)

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC     Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability     than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952,     CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967,     CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
    (CVE-2016-1089)

  - Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC     Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows     and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability     than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952,     CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967,     CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
    (CVE-2016-1091)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209376	Adobe Acrobat < 11.0.18 / 15.006.30243 / 15.020.20039 Multiple Vulnerabilities (APSB16-33) (macOS)	Nessus	MacOS X Local Security Checks	critical
209371	Adobe Reader < 15.006.30243 / 15.020.20039 Multiple Vulnerabilities (APSB16-33) (macOS)	Nessus	MacOS X Local Security Checks	critical
94074	Adobe Reader < 11.0.18 / 15.006.30243 / 15.020.20039 Multiple Vulnerabilities (APSB16-33) (macOS)	Nessus	MacOS X Local Security Checks	critical
94073	Adobe Acrobat < 11.0.18 / 15.006.30243 / 15.020.20039 Multiple Vulnerabilities (APSB16-33) (macOS)	Nessus	MacOS X Local Security Checks	critical
94072	Adobe Reader < 15.006.30243 / 15.020.20039 Multiple Vulnerabilities (APSB16-33)	Nessus	Windows	critical
94071	Adobe Acrobat < 11.0.18 / 15.006.30243 / 15.020.20039 Multiple Vulnerabilities (APSB16-33)	Nessus	Windows	critical

Detections

Analytics

CVE-2016-6977

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical