Vulnerability CVE-2014-9161 - CERT Civis.Net

Vulnerability Name:

CVE-2014-9161 (CCN-102757)

Assigned:

2014-10-30

Published:

2014-10-30

Updated:

2017-01-03

Summary:

CoolType.dll in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows, and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
7.3 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.9 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MISC
Type: UNKNOWN
http://code.google.com/p/google-security-research/issues/detail?id=149

Source: MITRE
Type: CNA
CVE-2014-9161

Source: MISC
Type: UNKNOWN
http://packetstormsecurity.com/files/134394/Adobe-Reader-X-XI-Out-Of-Bounds-Read.html

Source: BID
Type: UNKNOWN
74600

Source: CCN
Type: BID-74600
Adobe Reader and Acrobat Multiple Memory Corruption Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1032284

Source: XF
Type: UNKNOWN
adobe-reader-cve20149161-dos(102757)

Source: CCN
Type: Adobe Web site
Adobe Acrobat Reader DC

Source: CONFIRM
Type: Vendor Advisory
https://helpx.adobe.com/security/products/reader/apsb15-10.html

Source: CCN
Type: Packet Storm Security [11-17-2015]
Adobe Reader X / XI Out Of Bounds Read

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:acrobat_reader:10.1.13:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.10:*:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:adobe:acrobat:10.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.10:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.11:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:10.1.12:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.9:*:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:adobe:acrobat:10.1.13:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat:11.0.10:*:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:adobe:acrobat_reader:10.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.0.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.1:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.2:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.3:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.4:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.5:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.6:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.7:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.8:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.9:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.10:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.11:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:10.1.12:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.0:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.01:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.02:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.03:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.04:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.05:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.06:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.07:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.08:*:*:*:*:*:*:*

OR cpe:/a:adobe:acrobat_reader:11.0.09:*:*:*:*:*:*:*

AND

cpe:/o:apple:mac_os_x:*:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

Denotes that component is vulnerable