Integer overflow in Adobe Acrobat and Adobe Reader - CVE-2008-0726

Vulnerability identifier: #VU1334

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2008-0726

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in a JavaScript function. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Adobe Acrobat
Adobe Reader
SUSE Linux

Install update from vendor's website:

Adobe Reader 7 and 8:
https://www.adobe.com/products/acrobat/readstep2.html
Adobe Acrobat for Windows:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3849
Adobe Acrobat for Macintosh:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3856
Adobe Acrobat 3D version:
https://www.adobe.com/support/downloads/detail.jsp?ftpID=3850
Adobe Reader 7:
https://www.adobe.com/go/getreader
Adobe Acrobat 7 for Windows:
https://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
Adobe Acrobat 7 for Macintosh:
https://www.adobe.com/support/downloads/product.jsp?product=1&platform=Macintosh

• https://www.adobe.com/support/security/bulletins/apsb08-13.html

• Multiple vulnerabilities in Adobe Reader and Adobe Acrobat
• openSUSE update for flash-player