Detections
Analytics

Adobe Reader < 10.1.15 / 11.0.12 / 2015.006.30060 / 2015.008.20082 Multiple Vulnerabilities (APSB15-15) (Mac OS X)

critical Nessus Plugin ID 84803

Language:

Synopsis

The version of Adobe Reader installed on the remote Mac OS X host is affected by multiple vulnerabilities.

Description

The version of Adobe Reader installed on the remote host is a version prior to 10.1.15 / 11.0.12 / 2015.006.30060 / 2015.008.20082. It is, therefore, affected by multiple vulnerabilities :

 - A buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2015-5093)

 - Multiple heap buffer overflow conditions exist that allow an attacker to execute arbitrary code.
 (CVE-2015-5096, CVE-2015-5098, CVE-2015-5105)

 - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2015-5087, CVE-2015-5094, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, CVE-2015-3095, CVE-2015-5115, CVE-2014-0566)

 - An unspecified information disclosure vulnerability exists. (CVE-2015-5107)

 - Multiple security bypass vulnerabilities exist that allow an attacker to disclose arbitrary information.
 (CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, CVE-2015-5089, CVE-2015-5092, CVE-2014-8450)

 - A stack overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2015-5110)

 - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, CVE-2015-5113, CVE-2015-5114)

 - Multiple validation bypass issues exist that allow an attacker to escalate privileges. (CVE-2015-4446, CVE-2015-5090, CVE-2015-5106)

 - A validation bypass issue exists that allows an attacker to cause a denial of service condition. (CVE-2015-5091)

 - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2015-5097, CVE-2015-5108, CVE-2015-5109)

 - Multiple flaws exist that allow an attacker to bypass restrictions on the JavaScript API execution.
 (CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, CVE-2015-5086)

 - Multiple NULL pointer dereference flaws exist that allow an attacker to cause a denial of service condition.
 (CVE-2015-4443, CVE-2015-4444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Adobe Reader 10.1.15 / 11.0.12 / 2015.006.30060 / 2015.008.20082 or later.

See Also

https://helpx.adobe.com/security/products/acrobat/apsb15-15.html

Plugin Details

Severity: Critical

ID: 84803

File Name: macosx_adobe_reader_apsb15-15.nasl

Version: 1.10

Type: local

Agent: macosx

Published: 7/16/2015

Updated: 11/22/2019

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.6

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2015-5115

Vulnerability Information

CPE: cpe:/a:adobe:acrobat_reader

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, installed_sw/Adobe Reader

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/14/2015

Vulnerability Publication Date: 7/14/2015

Exploitable With

Core Impact

Reference Information

CVE: CVE-2014-0566, CVE-2014-8450, CVE-2015-3095, CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4443, CVE-2015-4444, CVE-2015-4445, CVE-2015-4446, CVE-2015-4447, CVE-2015-4448, CVE-2015-4449, CVE-2015-4450, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, CVE-2015-5086, CVE-2015-5087, CVE-2015-5088, CVE-2015-5089, CVE-2015-5090, CVE-2015-5091, CVE-2015-5092, CVE-2015-5093, CVE-2015-5094, CVE-2015-5095, CVE-2015-5096, CVE-2015-5097, CVE-2015-5098, CVE-2015-5099, CVE-2015-5100, CVE-2015-5101, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, CVE-2015-5105, CVE-2015-5106, CVE-2015-5107, CVE-2015-5108, CVE-2015-5109, CVE-2015-5110, CVE-2015-5111, CVE-2015-5113, CVE-2015-5114, CVE-2015-5115

BID: 69825, 75402, 75735, 75737, 75738, 75739, 75740, 75741, 75743, 75746, 75747, 75748, 75749