Adobe security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 124 vulnerabilities that were fixed in 2 bulletins announced today by Adobe. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Adobe has released 2 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Adobe Flash Player and AIR Multiple Vulnerabilities (APSA16-02) (APSB16-15)

  Severity

  Urgent 5

  Qualys ID

  120098

  Vendor Reference

  APSA16-02, APSB16-15

  CVE Reference

  CVE-2016-1096, CVE-2016-1097, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1101, CVE-2016-1102, CVE-2016-1103, CVE-2016-1104, CVE-2016-1105, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4109, CVE-2016-4110, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4116, CVE-2016-4117, CVE-2016-4120, CVE-2016-4121, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163

  CVSS Scores

  Base 10 / Temporal 8.7

  Description

  Adobe Flash Player is a multimedia application for multiple platforms.

  Adobe has released security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.

  Affected Versions:
  Adobe Flash Player Desktop Runtime 21.0.0.226 and earlier Adobe Flash Player Extended Support Release 18.0.0.343 and earlier AIR SDK 21.0.0.198 and earlier Note: Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild.

  Consequence

  Successful exploitation of this vulnerability will allow an attacker to execute arbitrary code, failed exploits may result in system crash.

  Solution

  The vendor has released an update to fix the vulnerabilities. Please refer to Adobe advisory APSA16-02 and APSB16-15 for more details.

  Workaround:
  Disable Adobe Flash Player

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  APSB16-15 Adobe Flash Player

• Adobe Acrobat and Reader Multiple Vulnerabilities (APSB16-14)

  Severity

  Critical 4

  Qualys ID

  123265

  Vendor Reference

  APSB16-14

  CVE Reference

  CVE-2016-1037, CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1043, CVE-2016-1044, CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1062, CVE-2016-1063, CVE-2016-1064, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1075, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1079, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1087, CVE-2016-1088, CVE-2016-1090, CVE-2016-1092, CVE-2016-1093, CVE-2016-1094, CVE-2016-1095, CVE-2016-1112, CVE-2016-1116, CVE-2016-1117, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1121, CVE-2016-1122, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4091, CVE-2016-4092, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4102, CVE-2016-4103, CVE-2016-4104, CVE-2016-4105, CVE-2016-4106, CVE-2016-4107, CVE-2016-4119

  CVSS Scores

  Base 10 / Temporal 8.7

  Description

  Adobe Reader and Acrobat are applications for handling PDF files. They are prone to multiple vulnerabilities that could potentially allow an attacker to take control of an affected system.

  Affected Software:
  Acrobat DC Continuous (15.010.20060) and earlier versions for Windows and Macintosh
  Acrobat Reader DC Continuous (15.010.20060) and earlier versions for Windows and Macintosh
  Acrobat DC Classic (15.006.30121) and earlier versions for Windows and Macintosh
  Acrobat Reader DC Classic (15.006.30121) and earlier versions for Windows and Macintosh
  Acrobat XI (11.0.15) and earlier versions for Windows and Macintosh
  Reader XI (11.0.15) and earlier versions for Windows and Macintosh

  Consequence

  Successful exploitation of these vulnerabilities could allow an attacker to compromise the affected system.

  Solution

  Users on Windows and Macintosh systems can utilize the Adobe product's update mechanism. The default configuration is set to run automatic update checks on a regular schedule.

  Refer to APSB16-14 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  APSB16-14 Adobe Acrobat
  APSB16-14 Adobe Reader

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.