Technical Description

Multiple vulnerabilities have been identified in Adobe Reader and Acrobat, which could be exploited by attackers to compromise a vulnerable system. These issues are caused by memory corruption errors, and integer and heap overflows in the JBIG2 filter and within the handling of PDF data, which could be exploited by attackers to execute arbitrary code by tricking a user into opening a specially crafted PDF document.

Affected Products

Adobe Reader versions prior to 9.1.2
Adobe Reader versions prior to 8.1.6
Adobe Reader versions prior to 7.1.3
Adobe Acrobat Standard versions prior to 9.1.2
Adobe Acrobat Pro versions prior to 9.1.2
Adobe Acrobat Pro Extended versions prior to 9.1.2
Adobe Acrobat versions prior to 8.1.6
Adobe Acrobat versions prior to 7.1.3

Solution

Upgrade to Adobe Reader and Acrobat version 9.1.2, 8.1.6 and 7.1.3 :
http://www.adobe.com/support/security/bulletins/apsb09-07.html

References

http://www.vupen.com/english/advisories/2009/1547
http://www.adobe.com/support/security/bulletins/apsb09-07.html

Credits

Vulnerabilities reported by Nicolas Joly (VUPEN Security), Will Dormann (CERT), Mark Dowd (IBM Internet Security Systems X-Force), Alin Rad Pop (Secunia Research), Matthew Watchinski (Sourcefire VRT), Apple Product Security Team, Haifei Li (Fortinet FortiGuard Global Security Research Team), Jun Mao and Ryan Smith (iDefense Labs), and ZDI.

ChangeLog

2009-06-10 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.