|
Some vulnerabilities have been reported in Adobe Reader/Acrobat, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a user's system. 1) Multiple boundary errors in several unspecified JavaScript methods can be exploited to cause stack-based buffer overflows via a specially crafted .PDF file. Successful exploitation allows execution of arbitrary code. NOTE: The vulnerability is reportedly being exploited in the wild. 2) An unspecified insecure JavaScript method in EScript.api can be exploited to execute arbitrary code via a specially crafted .PDF file. 3) An error in the loading of "Security Provider" libraries can be exploited to execute arbitrary code by e.g. tricking a user into opening a .PDF file in a directory that contains a malicious library with the same filename as a "Security Provider" library. 4) The insecure JavaScript method "DOC.print()" can be exploited to silently print a specially crafted PDF file. 5) An integer overflow in the "printSepsWithParams()" JavaScript method can be exploited to cause a memory corruption via a specially crafted .PDF file. Successful exploitation allows execution of arbitrary code. 6) Two boundary errors within Acrobat Distiller can be exploited to cause heap-based buffer overflows via specially crafted .joboptions files containing overly long (greater than 160 characters) font names within the "/AlwaysEmbed" and "/NeverEmbed" parameters. Successful exploitation allows execution of arbitrary code. The vulnerabilities affect the following versions:
* Adobe Reader 8.1.1 and earlier
* Adobe Acrobat Professional, 3D and Standard 8.1.1 and earlier
|
