CVE-2007-0045 Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x befor...
MediumCVSS 4.3
EPSS 47.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe acrobat | <= 7.0.8 | No fix listed |
| Adobe acrobat | = 7.0 | No fix listed |
| Adobe acrobat | = 7.0.1 | No fix listed |
| Adobe acrobat | = 7.0.2 | No fix listed |
| Adobe acrobat | = 7.0.3 | No fix listed |
| Adobe acrobat | = 7.0.4 | No fix listed |
| Adobe acrobat | = 7.0.5 | No fix listed |
| Adobe acrobat | = 7.0.6 | No fix listed |
| Adobe acrobat | = 7.0.7 | No fix listed |
| Adobe acrobat | = 7.0.8 | No fix listed |
| Adobe acrobat 3d | All versions | No fix listed |
| Adobe Acrobat Reader | <= 7.0.8 | No fix listed |
| Adobe Acrobat Reader | = 6.0 | No fix listed |
| Adobe Acrobat Reader | = 6.0.1 | No fix listed |
| Adobe Acrobat Reader | = 6.0.2 | No fix listed |
| Adobe Acrobat Reader | = 6.0.3 | No fix listed |
| Adobe Acrobat Reader | = 6.0.4 | No fix listed |
| Adobe Acrobat Reader | = 6.0.5 | No fix listed |
| Adobe Acrobat Reader | = 7.0 | No fix listed |
| Adobe Acrobat Reader | = 7.0.1 | No fix listed |
| Adobe Acrobat Reader | = 7.0.2 | No fix listed |
| Adobe Acrobat Reader | = 7.0.3 | No fix listed |
| Adobe Acrobat Reader | = 7.0.4 | No fix listed |
| Adobe Acrobat Reader | = 7.0.5 | No fix listed |
| Adobe Acrobat Reader | = 7.0.6 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe Acrobat Reader | = 7.0.7 | No fix listed |
| Adobe Acrobat Reader | = 7.0.8 | No fix listed |
References
- events.ccc.de
- googlechromereleases.blogspot.com
- HPSBUX02153 vendor-advisory
- SUSE-SA:2007:011 vendor-advisory
- 23483 third-party-advisory vendor-advisory
- 23691 third-party-advisory vendor-advisory
- 23812 third-party-advisory vendor-advisory
- 23877 third-party-advisory vendor-advisory
- 23882 third-party-advisory vendor-advisory
- 24457 third-party-advisory vendor-advisory
- 24533 third-party-advisory vendor-advisory
- 33754 third-party-advisory vendor-advisory
- GLSA-200701-16 vendor-advisory
- 2090 third-party-advisory
- 1017469 vdb-entry
- 1023007 vdb-entry
- SSA:2007-066-05 vendor-advisory
- 102847 vendor-advisory
- www.adobe.com vendor-advisory
- www.adobe.com
- www.adobe.com
- www.adobe.com
- www.disenchant.ch exploit
- www.gnucitizen.org exploit vendor-advisory
- www.gnucitizen.org
- VU#815960 third-party-advisory us-government-resource
- www.mozilla.org
- RHSA-2007:0021 vendor-advisory
- 20070103 Universal XSS with PDF files: highly dangerous exploit mailing-list
- 20070103 Re: Universal XSS with PDF files: highly dangerous mailing-list
- 20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities mailing-list
- 20070103 Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous exploit mailing-list
- 20070103 RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous mailing-list
- 20070104 Universal PDF XSS After Party mailing-list
- 21858 vdb-entry
- TA09-286B third-party-advisory us-government-resource
- ADV-2007-0032 vdb-entry vendor-advisory
- ADV-2007-0957 vdb-entry vendor-advisory
- ADV-2009-2898 vdb-entry vendor-advisory
- www.wisec.it exploit patch
- adobe-acrobat-pdf-xss(31271) vdb-entry
- oval:org.mitre.oval:def:6487 signature vdb-entry
- oval:org.mitre.oval:def:9693 signature vdb-entry
- RHSA-2007:0017 vendor-advisory