Memory corruption in Adobe Acrobat and Adobe Reader - CVE-2007-5663

Vulnerability identifier: #VU1333

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

CVE-ID: CVE-2007-5663

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Adobe

Affected software:
Adobe Acrobat
Adobe Reader

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow whithin JavaScript implementation. A remote attacker can create a specially .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Install update from vendor's website:

Adobe Reader 7 and 8:
https://www.adobe.com/products/acrobat/readstep2.html
Adobe Acrobat for Windows:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3849
Adobe Acrobat for Macintosh:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3856
Adobe Acrobat 3D version:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3850
Adobe Reader 7:
https://www.adobe.com/go/getreader
Adobe Acrobat 7 for Windows:
https://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
Adobe Acrobat 7 for Macintosh:
https://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

• https://www.adobe.com/support/security/bulletins/apsb08-13.html