Multiple unspecified vulnerabilities in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 have unknown impact and attack vectors, related to "Adobe internally discovered issues."

Updated acroread packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Adobe Reader allows users to view and print documents in Portable Document Format (PDF).

Multiple security flaws were discovered in Adobe Reader. A specially crafted PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader when opened.
(CVE-2009-0198, CVE-2009-0509, CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, CVE-2009-0889, CVE-2009-1855, CVE-2009-1856, CVE-2009-1857, CVE-2009-1858, CVE-2009-1859, CVE-2009-1861, CVE-2009-2028)

All Adobe Reader users should install these updated packages. They contain Adobe Reader version 8.1.6, which is not vulnerable to these issues. All running instances of Adobe Reader must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-200907-06 (Adobe Reader: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been reported in Adobe Reader:
    Alin Rad Pop of Secunia Research reported a heap-based buffer     overflow in the JBIG2 filter (CVE-2009-0198).
    Mark Dowd of the IBM Internet Security Systems X-Force and     Nicolas Joly of VUPEN Security reported multiple heap-based buffer     overflows in the JBIG2 filter (CVE-2009-0509, CVE-2009-0510,     CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, CVE-2009-0889)     Arr1val reported that multiple methods in the JavaScript API     might lead to memory corruption when called with crafted arguments     (CVE-2009-1492, CVE-2009-1493).
    An anonymous researcher reported a stack-based buffer overflow related     to U3D model files with a crafted extension block (CVE-2009-1855).
    Jun Mao and Ryan Smith of iDefense Labs reported an integer overflow     related to the FlateDecode filter, which triggers a heap-based buffer     overflow (CVE-2009-1856).
    Haifei Li of Fortinet's FortiGuard Global Security Research Team     reported a memory corruption vulnerability related to TrueType fonts     (CVE-2009-1857).
    The Apple Product Security Team reported a memory corruption     vulnerability in the JBIG2 filter (CVE-2009-1858).
    Matthew Watchinski of Sourcefire VRT reported an unspecified memory     corruption (CVE-2009-1859).
    Will Dormann of CERT reported multiple heap-based buffer overflows when     processing JPX (aka JPEG2000) stream that trigger heap memory     corruption (CVE-2009-1861).
    Multiple unspecified vulnerabilities have been discovered     (CVE-2009-2028).
  Impact :

    A remote attacker could entice a user to open a specially crafted     document, possibly resulting in the execution of arbitrary code with     the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
40746	RHEL 3 / 4 / 5 : acroread (RHSA-2009:1109)	Nessus	Red Hat Local Security Checks	critical
39777	GLSA-200907-06 : Adobe Reader: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2009-2028

high

Tenable Plugins

critical

critical