National Cyber Awareness System

Vulnerability Summary for CVE-2007-0046

Overview

Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: http://www.wisec.it/vulns.php?page=9

Type: Patch Information; Exploit

Hyperlink:http://www.wisec.it/vulns.php?page=9

External Source: VUPEN

Name: ADV-2007-0957

Hyperlink:http://www.vupen.com/english/advisories/2007/0957

External Source: VUPEN

Name: ADV-2007-0032

Hyperlink:http://www.vupen.com/english/advisories/2007/0032

External Source: BUGTRAQ

Name: 20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/455801/100/0/threaded

External Source: OVAL

Name: oval:org.mitre.oval:def:9684

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9684

External Source: MISC

Name: http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf

Hyperlink:http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf

External Source: REDHAT

Name: RHSA-2007:0017

Hyperlink:https://rhn.redhat.com/errata/RHSA-2007-0017.html

External Source: XF

Name: adobe-acrobat-msvcrt-code-execution(31272)

Hyperlink:http://xforce.iss.net/xforce/xfdb/31272

External Source: REDHAT

Name: RHSA-2007:0021

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0021.html

External Source: CONFIRM

Name: http://www.adobe.com/support/security/bulletins/apsb07-01.html

Hyperlink:http://www.adobe.com/support/security/bulletins/apsb07-01.html

External Source: SUNALERT

Name: 102847

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1

External Source: SECTRACK

Name: 1017469

Hyperlink:http://securitytracker.com/id?1017469

External Source: SREASON

Name: 2090

Hyperlink:http://securityreason.com/securityalert/2090

External Source: GENTOO

Name: GLSA-200701-16

Hyperlink:http://security.gentoo.org/glsa/glsa-200701-16.xml

External Source: SECUNIA

Name: 24533

Hyperlink:http://secunia.com/advisories/24533

External Source: SECUNIA

Name: 23882

Hyperlink:http://secunia.com/advisories/23882

External Source: SECUNIA

Name: 23877

Hyperlink:http://secunia.com/advisories/23877

External Source: SECUNIA

Name: 23812

Hyperlink:http://secunia.com/advisories/23812

External Source: SECUNIA

Name: 23691

Hyperlink:http://secunia.com/advisories/23691

External Source: SUSE

Name: SUSE-SA:2007:011

Hyperlink:http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html

References to Check Content

Identifier:oval:org.mitre.oval:def:9684

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9684