Adobe Security Bulletin

Release date: October 13, 2015

Last updated: December 11, 2015

Vulnerability identifier: APSB15-24

Priority: See table below

CVE numbers: CVE-2015-5583, CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6685, CVE-2015-6686, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-6692, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, CVE-2015-6696, CVE-2015-6697, CVE-2015-6698, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, CVE-2015-6704, CVE-2015-6705, CVE-2015-6706, CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7615, CVE-2015-7616, CVE-2015-7617, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, CVE-2015-7621, CVE-2015-7622, CVE-2015-7623, CVE-2015-7624, CVE-2015-7650, CVE-2015-8458

Platform: Windows and Macintosh

Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

For questions regarding Acrobat DC, please visit the Acrobat DC FAQ page. For questions regarding Acrobat Reader DC, please visit the Acrobat Reader DC FAQ page.   

Adobe recommends users update their software installations to the latest versions by following the instructions below.

The latest product versions are available to end users via one of the following methods:

• Users can update their product installations manually by choosing Help > Check for Updates.
• The products will update automatically, without requiring user intervention, when updates are detected. 
• The full Acrobat Reader installer can be downloaded from the Acrobat Reader Download Center.

For IT administrators (managed environments): 

• Download the enterprise installers from ftp://ftp.adobe.com/pub/adobe/, or refer to the specific release note version for links to installers.
• Install updates via your preferred methodology, such as AIP-GPO, bootstrapper, SCUP/SCCM (Windows), or on Macintosh, Apple Remote Desktop and SSH.

• These updates resolve a buffer overflow vulnerability that could lead to information disclosure (CVE-2015-6692).
• These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-6689, CVE-2015-6688, CVE-2015-6690, CVE-2015-7615, CVE-2015-7617, CVE-2015-6687, CVE-2015-6684, CVE-2015-6691, CVE-2015-7621, CVE-2015-5586, CVE-2015-6683).
• These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2015-6696, CVE-2015-6698, CVE-2015-8458).
• These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2015-6685, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, CVE-2015-6686, CVE-2015-7622, CVE-2015-7650).
• These updates resolve memory leak vulnerabilities (CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, CVE-2015-6704, CVE-2015-6697).
• These updates resolve security bypass vulnerabilities that could lead to information disclosure (CVE-2015-5583, CVE-2015-6705, CVE-2015-6706, CVE-2015-7624).
• These updates resolve various methods to bypass restrictions on Javascript API execution (CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-7614, CVE-2015-7616, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, CVE-2015-7623, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715).

Adobe would like to thank the following individuals and organizations for reporting the relevant issues and for working with Adobe to help protect our customers:

• AbdulAziz Hariri of HP Zero Day Initiative (CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-7614, CVE-2015-7616, CVE-2015-6689, CVE-2015-6688, CVE-2015-6690, CVE-2015-7615, CVE-2015-7617, CVE-2015-6697, CVE-2015-6685, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, CVE-2015-6707)
• AbdulAziz Hariri and Jasiel Spelman of HP Zero Day Initiative (CVE-2015-5583, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, CVE-2015-6704)
• Alex Inführ of Cure53.de (CVE-2015-6705, CVE-2015-6706)
• Bill Finlayson of Vectra Networks (CVE-2015-6687)
• bilou working with VeriSign iDefense Labs (CVE-2015-6684)
• Brian Gorenc of HP Zero Day Initiative (CVE-2015-6686)
• Francis Provencher from COSIG (CVE-2015-7622)
• Jaanus Kp of Clarified Security working with HP's Zero Day Initiative (CVE-2015-6696, CVE-2015-6698)
• Jack Tang of TrendMicro (CVE-2015-6692)
• James Loureiro of MWR Labs (CVE-2015-6691)
• Joel Brewer (CVE-2015-7624)
• kdot working with HP's's Zero Day Initiative (CVE-2015-7621, CVE-2015-7650)
• Matt Molinyawe and Jasiel Spelman of HP's Zero Day Initiative (CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620)
• Matt Molinyawe of HP Zero Day Initiative (CVE-2015-7623)
• WanderingGlitch of HP's Zero Day Initiative (CVE-2015-6713, CVE-2015-6714, CVE-2015-6715)
• Wei Lei and Wu Hongjun of Nanyang Technological University (CVE-2015-5586)
• Wei Lei, as well as Wu Hongjun of Nanyang Technological University working with Verisign iDefense Labs (CVE-2015-6683)
• AbdulAziz Hariri and Jasiel Spelman of HP Zero Day Initiative for defense-in-depth contributions
• Fritz Sands working with HP's Zero Day Initiative (CVE-2015-8458)
  

October 14, 2015: Corrected erroneous CVE details and acknowledgments

October 29, 2015: Added a reference to CVE-2015-7829, which was reported as a vulnerability in Acrobat and Reader but resolved via a security fix in Windows referenced in MS15-090.  Also, added a reference to CVE-2015-7650, which was fixed in the October 13 release of Acrobat and Reader but accidentally omitted from the bulletins. 

December 11, 2015: Added a reference to CVE-2015-8458, which was fixed in the October 13 release of Acrobat and Reader but accidentally omitted from the bulletins.