Adobe Acrobat Reader DC 15.016.20045 – Invalid Font ‘.ttf’ Memory Corruption (6)
##################################################################################### # Application: Adobe Acrobat Reader DC # Platforms: Windows,OSX # Versions: 15.016.20045 and earlier # Author: Sébastien Morin of COSIG # Website: https://cosig.gouv.qc.ca/en/advisory/ # Twitter: @COSIG_ # Date: July 12, 2016 # CVE: CVE-2016-4206 # COSIG-2016-25 ##################################################################################### 1) Introduction 2) Report Timeline 3) Technical details 4) POC ##################################################################################### ================ 1) Introduction ================ Adobe Acrobat is a family of application software and Web services developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format (PDF). (https://en.wikipedia.org/wiki/Adobe_Acrobat) ##################################################################################### ==================== 2) Report Timeline ==================== 2016-05-18: Sébastien Morin of COSIG report this vulnerability to Adobe PSIRT; 2016-06-08: Adobe PSIRT confirm this vulnerability; 2016-07-12: Adobe fixed the issue (APSB16-26); 2016-07-12: Advisory released by COSIG; ##################################################################################### ===================== 3) Technical details ===================== The vulnerability allows a remote attacker to execute malicious code or access to part of dynamically allocated memory using a user interaction that opens a specially crafted PDF file containing an invalid font (.ttf ) including invalid data. ##################################################################################### =========== 4) POC =========== https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-25.pdf https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40100.zip #################################################################################### |