CVE-2008-2992 Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted...
HighCVSS 7.8
EPSS 99.8%
CISA KEV
added 2022-03-03 · due 2022-03-24
Ransomware
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe acrobat | <= 8.1.2 | No fix listed |
| Adobe Acrobat Reader | <= 8.1.2 | No fix listed |
| oracle solaris | = 10 | No fix listed |
References
- 249366 third-party-advisory vendor-advisory
- SUSE-SR:2008:026 mailing-list third-party-advisory vendor-advisory
- 49520 broken-link vdb-entry
- 29773 broken-link third-party-advisory vendor-advisory
- 32700 broken-link third-party-advisory vendor-advisory
- 32872 broken-link third-party-advisory vendor-advisory
- 35163 broken-link third-party-advisory vendor-advisory
- secunia.com broken-link vendor-advisory
- 4549 broken-link exploit third-party-advisory
- support.nortel.com broken-link
- support.nortel.com broken-link
- www.adobe.com broken-link patch vendor-advisory
- www.coresecurity.com third-party-advisory
- VU#593409 third-party-advisory us-government-resource
- RHSA-2008:0974 broken-link patch vendor-advisory
- 20081104 Secunia Research: Adobe Acrobat/Reader "util.printf()" Buffer Overflow broken-link mailing-list third-party-advisory vdb-entry
- 20081104 CORE-2008-0526: Adobe Reader Javascript Printf Buffer Overflow broken-link mailing-list third-party-advisory vdb-entry
- 20081104 ZDI-08-072: Adobe Acrobat PDF Javascript printf Stack Overflow Vulnerability broken-link mailing-list third-party-advisory vdb-entry
- 30035 broken-link third-party-advisory vdb-entry
- 32091 broken-link third-party-advisory vdb-entry
- 1021140 broken-link third-party-advisory vdb-entry
- TA08-309A broken-link third-party-advisory us-government-resource
- ADV-2008-3001 broken-link vdb-entry vendor-advisory
- ADV-2009-0098 broken-link vdb-entry vendor-advisory
- www.zerodayinitiative.com third-party-advisory vdb-entry
- 6994 exploit third-party-advisory vdb-entry
- 7006 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource