CVE-2015-6713

Vulnerability

The vulnerability resides in the Function.call implementation within the JavaScript engine of Adobe Reader and Acrobat. Affected versions include Reader and Acrobat 10.x before 10.1.16, 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and DC Continuous before 2015.009.20069 on Windows and OS X. By crafting a PDF with specific JavaScript instructions, an attacker can bypass the intended security restrictions on JavaScript API calls [1].

Exploitation

Exploitation requires user interaction — the target must open a malicious PDF file or visit a page that loads the exploit. No authentication or special network position is needed beyond delivering the file. The attacker creates a specially crafted PDF that leverages the Function.call method to evade API restrictions [1].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code in the context of the current user. This can lead to full compromise of confidentiality, integrity, and availability, as an attacker could read, modify, or delete files, install malware, or perform other malicious actions [1]. The CVSS v2 score is 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) [1].

Mitigation

Adobe released fixes starting October 13, 2015. Users should update to the following versions or later: Reader/Acrobat 10.1.16, 11.0.13, DC Classic 2015.006.30094, and DC Continuous 2015.009.20069. No workaround is available; applying the latest patch is the only mitigation [1].