Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

SunOS 5.10: Adobe Acrobat Reader patch.
Date this patch was last updated by Sun : Nov/27/09

Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 23 Jan 2007] The previous acroread packages were missing dependencies on the new libraries which could prevent acroread from starting. Replacement acroread packages have been added to this erratum to correct this issue.

The Adobe Reader allows users to view and print documents in portable document format (PDF).

A cross site scripting flaw was found in the way the Adobe Reader Plugin processes certain malformed URLs. A malicious web page could inject arbitrary javascript into the browser session which could possibly lead to a cross site scripting attack. (CVE-2007-0045)

Two arbitrary code execution flaws were found in the way Adobe Reader processes malformed document files. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious PDF file. (CVE-2006-5857, CVE-2007-0046)

Please note that Adobe Reader 7.0.9 requires versions of several system libraries that were not shipped with Red Hat Enterprise Linux 3. This update contains additional packages that provide the required system library versions for Adobe Reader. These additional packages are only required by Adobe Reader and do not replace or affect any other aspects of a Red Hat Enterprise Linux 3 system.

All users of Adobe Reader are advised to upgrade to these updated packages, which contain Adobe Reader version 7.0.9 and additional libraries to correct these issues.

Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Adobe Acrobat Reader allows users to view and print documents in portable document format (PDF).

A cross site scripting flaw was found in the way the Adobe Reader Plugin processes certain malformed URLs. A malicious web page could inject arbitrary javascript into the browser session which could possibly lead to a cross site scripting attack. (CVE-2007-0045)

Two arbitrary code execution flaws were found in the way Adobe Reader processes malformed document files. It may be possible to execute arbitrary code on a victim's machine if the victim opens a malicious PDF file. (CVE-2006-5857, CVE-2007-0046)

All users of Acrobat Reader are advised to upgrade to these updated packages, which contain Acrobat Reader version 7.0.9 and are not vulnerable to these issues.

Adobe Reader has been updated to fix numerous security vulnerabilities. Some of the vulnerabilities allowed attackers to potentially execute arbitrary code on the victim's system via specially crafted PDF files.

(CVE-2007-0048 / CVE-2007-0045 / CVE-2009-2564 / CVE-2009-2979 / CVE-2009-2980 / CVE-2009-2981 / CVE-2009-2982 / CVE-2009-2983 / CVE-2009-2985 / CVE-2009-2986 / CVE-2009-2988 / CVE-2009-2990 / CVE-2009-2991 / CVE-2009-2992 / CVE-2009-2993 / CVE-2009-2994 / CVE-2009-2996 / CVE-2009-2997 / CVE-2009-2998 / CVE-2009-3431 / CVE-2009-3458 / CVE-2009-3459 / CVE-2009-3462)

Adobe Reader has been updated to fix numerous security vulnerabilities. Some of the vulnerabilities allowed attackers to potentially execute arbitrary code on the victim's system via specially crafted PDF files.

(CVE-2007-0048, CVE-2007-0045, CVE-2009-2564,CVE-2009-2979, CVE-2009-2980, CVE-2009-2981, CVE-2009-2982, CVE-2009-2983, CVE-2009-2985, CVE-2009-2986, CVE-2009-2988, CVE-2009-2990, CVE-2009-2991, CVE-2009-2992, CVE-2009-2993, CVE-2009-2994, CVE-2009-2996, CVE-2009-2997, CVE-2009-2998, CVE-2009-3431, CVE-2009-3458, CVE-2009-3459, CVE-2009-3462)

The remote host is affected by the vulnerability described in GLSA-200910-03 (Adobe Reader: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in Adobe Reader. For further     information please consult the CVE entries and the Adobe Security     Bulletin referenced below.
  Impact :

    A remote attacker might entice a user to open a specially crafted PDF     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running the application, Denial of Service, the     creation of arbitrary files on the victim's system, 'Trust Manager'     bypass, or social engineering attacks.
  Workaround :

    There is no known workaround at this time.

The version of Adobe Reader installed on the remote host is earlier than 9.2 / 8.1.7 / 7.1.4.  Such versions are potentially affected by multiple vulnerabilities :

  - A heap overflow vulnerability. (CVE-2009-3459)

  - A memory corruption issue. (CVE-2009-2985)

  - Multiple heap overflow vulnerabilities. (CVE-2009-2986)

  - An invalid array index issue that could lead to code     execution. (CVE-2009-2990)

  - Multiple input validation vulnerabilities that could     lead to code execution. (CVE-2009-2993)

  - A buffer overflow issue. (CVE-2009-2994)

  - A heap overflow vulnerability. (CVE-2009-2997)

  - An input validation issue that could lead to code     execution. (CVE-2009-2998)

  - An input validation issue that could lead to code     execution. (CVE-2009-3458)

  - A memory corruption issue that leads to a denial of     service. (CVE-2009-2983)

  - An integer overflow that leads to a denial of service.
    (CVE-2009-2980)

  - A memory corruption issue that leads to a denial of     service. (CVE-2009-2996)

  - An input validation issue that could lead to a bypass     of Trust Manager restrictions. (CVE-2009-2981)

  - A certificate is used that, if compromised, could be used     in a social engineering attack. (CVE-2009-2982)

  - A stack overflow issue that could lead to a denial of     service. (CVE-2009-3431)

  - A XMP-XML entity expansion issue that could lead to a     denial of service attack. (CVE-2009-2979)

  - A remote denial of service issue in the ActiveX control.
    (CVE-2009-2987)

  - An input validation issue. (CVE-2009-2988)

  - An input validation issue specific to the ActiveX     control. (CVE-2009-2992)

  - A third-party web download product is used that could     lead to a local privilege escalation. (CVE-2009-2564)

  - A cross-site scripting issue when the browser plugin in     used with Google Chrome and Opera browsers.
    (CVE-2007-0048, CVE-2007-0045)

The version of Adobe Acrobat installed on the remote host is earlier than 9.2 / 8.1.7 / 7.1.4. Such versions are reportedly affected by multiple vulnerabilities :

  - A heap overflow vulnerability. (CVE-2009-3459)

  - A memory corruption issue. (CVE-2009-2985)

  - Multiple heap overflow vulnerabilities. (CVE-2009-2986)

  - An invalid array index issue that could lead to code     execution. (CVE-2009-2990)

  - Multiple input validation vulnerabilities that could     lead to code execution. (CVE-2009-2993)

  - A buffer overflow issue. (CVE-2009-2994)

  - A heap overflow vulnerability. (CVE-2009-2997)

  - An input validation issue that could lead to code     execution. (CVE-2009-2998)

  - An input validation issue that could lead to code     execution. (CVE-2009-3458)

  - A memory corruption issue. (CVE-2009-3460)

  - An issue that could allow a malicious user to bypass     file extension security controls. (CVE-2009-3461)

  - An integer overflow vulnerability. (CVE-2009-2989)

  - A memory corruption issue that leads to a denial of     service. (CVE-2009-2983)

  - An integer overflow that leads to a denial of service.
    (CVE-2009-2980)

  - A memory corruption issue that leads to a denial of     service. (CVE-2009-2996)

  - An image decoder issue that leads to a denial of service.
    (CVE-2009-2984)

  - An input validation issue that could lead to a bypass     of Trust Manager restrictions. (CVE-2009-2981)

  - A certificate is used that, if compromised, could be used     in a social engineering attack. (CVE-2009-2982)

  - A stack overflow issue that could lead to a denial of     service. (CVE-2009-3431)

  - A XMP-XML entity expansion issue that could lead to a     denial of service attack. (CVE-2009-2979)

  - A remote denial of service issue in the ActiveX control.
    (CVE-2009-2987)

  - An input validation issue. (CVE-2009-2988)

  - An input validation issue specific to the ActiveX     control. (CVE-2009-2992)

  - A cross-site scripting issue when the browser plugin in     used with Google Chrome and Opera browsers.     (CVE-2007-0048, CVE-2007-0045)

The Adobe Acrobat Reader has been updated to version 7.0.9.

For SUSE Linux Enterprise Server 9 this version now includes its own GLIB2, ATK, PANGO and GTK2 libraries, since Acroread 7.0.x requires a minimum level of GTK2 2.4.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

  - CVE-2007-0047 and CVE-2007-0048 affect only Microsoft     Windows and Internet Explorer.

The version of Adobe Acrobat installed on the remote host is earlier than 6.0.6 / 7.0.9 / 8.0 and thus reportedly is affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The version of Google Chrome installed on the remote host is earlier than 1.0.154.46.  Such versions are reportedly affected by several issues :

  - Cross-site scripting vulnerabilities in the Adobe Reader     Plugin itself could be leveraged using a PDF document to     run scripts on arbitrary sites via Google Chrome.
    (CVE-2007-0048 and CVE-2007-0045)

  - A cross-domain security-bypass vulnerability that could     allow an attacker to bypass the same-origin policy and     gain access to potentially sensitive information.
    (CVE-2009-0276)

  - A remote attacker may be able to gain access to the     'Set-Cookie' and 'Set-Cookie2' response headers via     XMLHttpRequest calls. (CVE-2009-0411)

The Adobe Acrobat Reader (Japanese version) has been updated to version 7.0.9.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

  - A memory corruption problem was fixed in Adobe Acrobat     Reader can potentially lead to code execution.
    (CVE-2006-5857)

  - Universal cross-site request forgery (CSRF) problems     were fixed in the Acrobat Reader plugin which could be     exploited by remote attackers to conduct CSRF attacks     using any site that is providing PDFs. (CVE-2007-0044)

  - Cross-site scripting problems in the Acrobat Reader     plugin were fixed, which could be exploited by remote     attackers to conduct XSS attacks against any site that     is providing PDFs. (CVE-2007-0045)

  - A double free problem in the Acrobat Reader plugin was     fixed which could be used by remote attackers to     potentially execute arbitrary code. Note that all     platforms using Adobe Reader currently have counter     measures against such attack where it will just cause a     controlled abort(). (CVE-2007-0046)

The Adobe Acrobat Reader has been updated to version 7.0.9.

This update also includes following security fixes :

CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution.

CVE-2007-0044: Universal Cross Site Request Forgery (CSRF) problems were fixed in the Acrobat Reader plugin which could be exploited by remote attackers to conduct CSRF attacks using any site that is providing PDFs.

CVE-2007-0045: Cross site scripting problems in the Acrobat Reader plugin were fixed, which could be exploited by remote attackers to conduct XSS attacks against any site that is providing PDFs.

CVE-2007-0046: A double free problem in the Acrobat Reader plugin was fixed which could be used by remote attackers to potentially execute arbitrary code. Note that all platforms using Adobe Reader currently have counter measures against such attack where it will just cause a controlled abort().

CVE-2007-0047 and CVE-2007-0048 affect only Microsoft Windows and Internet Explorer.

Several remote vulnerabilities have been discovered in Mozilla Firefox.

This will be the last security update of Mozilla-based products for the oldstable (sarge) distribution of Debian. We recommend to upgrade to stable (etch) as soon as possible.

The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2007-1282     It was discovered that an integer overflow in     text/enhanced message parsing allows the execution of     arbitrary code.

  - CVE-2007-0994     It was discovered that a regression in the JavaScript     engine allows the execution of JavaScript with elevated     privileges.

  - CVE-2007-0995     It was discovered that incorrect parsing of invalid HTML     characters allows the bypass of content filters.

  - CVE-2007-0996     It was discovered that insecure child frame handling     allows cross-site scripting.

  - CVE-2007-0981     It was discovered that Firefox handles URI with a null     byte in the hostname insecurely.

  - CVE-2007-0008     It was discovered that a buffer overflow in the NSS code     allows the execution of arbitrary code.

  - CVE-2007-0009     It was discovered that a buffer overflow in the NSS code     allows the execution of arbitrary code.

  - CVE-2007-0775     It was discovered that multiple programming errors in     the layout engine allow the execution of arbitrary code.

  - CVE-2007-0778     It was discovered that the page cache calculates hashes     in an insecure manner.

  - CVE-2006-6077     It was discovered that the password manager allows the     disclosure of passwords.

A new seamonkey package is available for Slackware 11.0 to fix security issues.

The remote host is affected by the vulnerability described in GLSA-200701-16 (Adobe Acrobat Reader: Multiple vulnerabilities)

    Adobe Acrobat Reader in stand-alone mode is vulnerable to remote code     execution via heap corruption when loading a specially crafted PDF     file.
    The browser plugin released with Adobe Acrobat Reader (nppdf.so) does     not properly handle URLs, and crashes if given a URL that is too long.
    The plugin does not correctly handle JavaScript, and executes     JavaScript that is given as a GET variable to the URL of a PDF file.
    Lastly, the plugin does not properly handle the FDF, xml, xfdf AJAX     request parameters following the # character in a URL, allowing for     multiple cross-site scripting vulnerabilities.
  Impact :

    An attacker could entice a user to open a specially crafted PDF file     and execute arbitrary code with the rights of the user running Adobe     Acrobat Reader. An attacker could also entice a user to browse to a     specially crafted URL and either crash the Adobe Acrobat Reader browser     plugin, execute arbitrary JavaScript in the context of the user's     browser, or inject arbitrary HTML or JavaScript into the document being     viewed by the user. Note that users who have emerged Adobe Acrobat     Reader with the 'nsplugin' USE flag disabled are not vulnerable to     issues with the Adobe Acrobat Reader browser plugin.
  Workaround :

    There is no known workaround at this time.

The version of Adobe Reader installed on the remote host is earlier than 7.0.9 / 8.0 and is, therefore, reportedly affected by several security issues, including one that can lead to arbitrary code execution when processing a malicious PDF file.

The version of Adobe PDF Plug-In installed on the remote host is earlier than 8.0 / 7.0.9 / 6.0.6 and reportedly fails to properly sanitize input to the 'FDF', 'XML', or 'XFDF' fields used by its 'Open Parameters' feature. By tricking a user into accessing a specially crafted link and depending on the browser with which the plugin is used, a remote attacker may be able to leverage these issues to conduct arbitrary code execution, denial of service, cross-site script forgery, or cross-site scripting attacks against a user on the remote host.

The version of Google Chrome installed on the remote host is earlier than 1.0.154.46.  Such versions are reportedly affected by several issues : 

  - Cross-site scripting vulnerabilities in the Adobe Reader Plugin itself could be leveraged using a PDF document to run scripts on arbitrary sites via Google Chrome.  (CVE-2007-0048 and CVE-2007-0045)

  - A cross-domain security bypass vulnerability that could allow an attacker to bypass the same-origin policy and gain access to potentially sensitive information. (CVE-2009-0276)

ID	Name	Product	Family	Severity
107373	Solaris 10 (sparc) : 121104-11	Nessus	Solaris Local Security Checks	high
63836	RHEL 3 : Adobe Acrobat Reader (RHSA-2007:0021)	Nessus	Red Hat Local Security Checks	high
63835	RHEL 4 : Adobe Acrobat Reader (RHSA-2007:0017)	Nessus	Red Hat Local Security Checks	high
51709	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6585)	Nessus	SuSE Local Security Checks	high
51708	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6584)	Nessus	SuSE Local Security Checks	high
51694	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6583)	Nessus	SuSE Local Security Checks	high
51693	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6582)	Nessus	SuSE Local Security Checks	high
42318	openSUSE 10 Security Update : acroread (acroread-6588)	Nessus	SuSE Local Security Checks	high
42251	SuSE 11 Security Update : acroread_ja (SAT Patch Number 1424)	Nessus	SuSE Local Security Checks	high
42250	SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 1425)	Nessus	SuSE Local Security Checks	high
42247	openSUSE Security Update : acroread (acroread-1426)	Nessus	SuSE Local Security Checks	high
42244	openSUSE Security Update : acroread (acroread-1426)	Nessus	SuSE Local Security Checks	high
42239	GLSA-200910-03 : Adobe Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
42120	Adobe Reader < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)	Nessus	Windows	high
42119	Adobe Acrobat < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)	Nessus	Windows	high
41117	SuSE9 Security Update : acroread (YOU Patch Number 11433)	Nessus	SuSE Local Security Checks	high
40798	Adobe Acrobat < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	high
35558	Google Chrome < 1.0.154.46 Multiple Vulnerabilities	Nessus	Windows	medium
29371	SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 2545)	Nessus	SuSE Local Security Checks	high
29370	SuSE 10 Security Update : acroread (ZYPP Patch Number 2508)	Nessus	SuSE Local Security Checks	high
27144	openSUSE 10 Security Update : acroread (acroread-2506)	Nessus	SuSE Local Security Checks	high
25779	Debian DSA-1336-1 : mozilla-firefox - several vulnerabilities	Nessus	Debian Local Security Checks	high
24791	Slackware 11.0 : seamonkey (SSA:2007-066-05)	Nessus	Slackware Local Security Checks	high
24252	GLSA-200701-16 : Adobe Acrobat Reader: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24002	Adobe Reader < 6.0.6 / 7.0.9 Multiple Vulnerabilities	Nessus	Windows	high
23975	Adobe PDF Plug-In < 8.0 / 7.0.9 / 6.0.6 Multiple Vulnerabilities (APSB07-01)	Nessus	Windows	high
800951	Google Chrome < 1.0.154.46 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2007-0045

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

medium