The version of Adobe Reader installed on the remote host is earlier than 8.1.3.  Such versions are reportedly affected by multiple vulnerabilities :

  - There is a publicly-published denial of service issue     (CVE-2008-2549).

  - A stack-based buffer overflow when parsing format     strings containing a floating point specifier in the     'util.printf()' JavaScript function may allow an     attacker to execute arbitrary code (CVE-2008-2992).

  - Multiple input validation errors could lead to code     execution (CVE-2008-4812).

  - Multiple input validation issues could lead to remote     code execution. (CVE-2008-4813)

  - A heap corruption vulnerability in an AcroJS function     available to scripting code inside of a PDF document     could lead to remote code execution. (CVE-2008-4817)

  - An input validation issue in the Download Manager used     by Adobe Reader could lead to remote code execution     during the download process (CVE-2008-5364).

  - An issue in the Download Manager used by Adobe Reader     could lead to a user's Internet Security options being     changed during the download process (CVE-2008-4816).

  - An input validation issue in a JavaScript method could     lead to remote code execution (CVE-2008-4814).

Updated acroread packages that fix various security issues are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Adobe Reader allows users to view and print documents in Portable Document Format (PDF).

Several input validation flaws were discovered in Adobe Reader. A malicious PDF file could cause Adobe Reader to crash or, potentially, execute arbitrary code as the user running Adobe Reader.
(CVE-2008-2549, CVE-2008-2992, CVE-2008-4812, CVE-2008-4813, CVE-2008-4814, CVE-2008-4817)

The Adobe Reader binary had an insecure relative RPATH (runtime library search path) set in the ELF (Executable and Linking Format) header. A local attacker able to convince another user to run Adobe Reader in an attacker-controlled directory could run arbitrary code with the privileges of the victim. (CVE-2008-4815)

All acroread users are advised to upgrade to these updated packages, that contain Adobe Reader version 8.1.3, and are not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200901-09 (Adobe Reader: User-assisted execution of arbitrary code)

    An unspecified vulnerability can be triggered by a malformed PDF     document, as demonstrated by 2008-HI2.pdf (CVE-2008-2549).
    Peter Vreugdenhil, Dyon Balding, Will Dormann, Damian Frizza, and Greg     MacManus reported a stack-based buffer overflow in the util.printf     JavaScript function that incorrectly handles the format string argument     (CVE-2008-2992).
    Greg MacManus of iDefense Labs reported an array index error that can     be leveraged for an out-of-bounds write, related to parsing of Type 1     fonts (CVE-2008-4812).
    Javier Vicente Vallejo and Peter Vregdenhil, via Zero Day Initiative,     reported multiple unspecified memory corruption vulnerabilities     (CVE-2008-4813).
    Thomas Garnier of SkyRecon Systems reported an unspecified     vulnerability in a JavaScript method, related to an 'input validation     issue' (CVE-2008-4814).
    Josh Bressers of Red Hat reported an untrusted search path     vulnerability (CVE-2008-4815).
    Peter Vreugdenhil reported through iDefense that the Download Manager     can trigger a heap corruption via calls to the AcroJS function     (CVE-2008-4817).
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF     document, and local attackers could entice a user to run acroread from     an untrusted working directory. Both might result in the execution of     arbitrary code with the privileges of the user running the application,     or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

The version of Adobe Acrobat installed on the remote host is earlier than 9.0 / 8.1.3.  Such versions are reportedly affected by multiple vulnerabilities :

  - There is a published denial of service issue.
    (CVE-2008-2549)

  - A stack-based buffer overflow when parsing format     strings containing a floating point specifier in the     'util.printf()' JavaScript function may allow an     attacker to execute arbitrary code. (CVE-2008-2992)

  - Multiple input validation errors could lead to code     execution. (CVE-2008-4812)

  - Multiple input validation issues could lead to remote     code execution. (CVE-2008-4813)

  - A heap corruption vulnerability in an AcroJS function     available to scripting code inside of a PDF document     could lead to remote code execution. (CVE-2008-4817)

  - An input validation issue in the Download Manager used     by Adobe Acrobat could lead to remote code execution     during the download process. (CVE-2008-5364)

  - An issue in the Download Manager used by Adobe Acrobat     could lead to a user's Internet Security options being     changed during the download process. (CVE-2008-4816)

  - An input validation issue in a JavaScript method could     lead to remote code execution. (CVE-2008-4814)

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992, CVE-2008-2549, CVE-2008-4812, CVE-2008-4813, CVE-2008-4817, CVE-2008-4816, CVE-2008-4814, CVE-2008-4815)

The acroread package was update to fix several security vulnerabilities in the JavaScript engine. (CVE-2008-2992 / CVE-2008-2549 / CVE-2008-4812 / CVE-2008-4813 / CVE-2008-4817 / CVE-2008-4816 / CVE-2008-4814 / CVE-2008-4815)

ID	Name	Product	Family	Published	Updated	Severity
34695	Adobe Reader < 8.1.3 / 9.0 Multiple Vulnerabilities	Nessus	Windows	11/4/2008	3/8/2022	high
40730	RHEL 3 / 4 / 5 : acroread (RHSA-2008:0974)	Nessus	Red Hat Local Security Checks	8/24/2009	3/28/2022	high
35367	GLSA-200901-09 : Adobe Reader: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	1/14/2009	3/8/2022	high
40802	Adobe Acrobat < 8.1.3 Multiple Vulnerabilities	Nessus	Windows	8/28/2009	5/31/2024	high
39905	openSUSE Security Update : acroread (acroread-295)	Nessus	SuSE Local Security Checks	7/21/2009	3/8/2022	high
34943	openSUSE 10 Security Update : acroread (acroread-5749)	Nessus	SuSE Local Security Checks	11/24/2008	3/8/2022	high
34942	SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 5746)	Nessus	SuSE Local Security Checks	11/24/2008	3/8/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high