In-depth research on the recent PDF zero-day exploit (CVE-2009-3459)

Hi there, Just want to let you know, the Fortinet's FortiGuard Global Security Research Team has provided an in-depth research on the recent PDF zero-day exploit CVE-2009-3459. http://www.fortiguard.com/analysis/pdfanalysis.html "Taking a look back over this 0-day attack as a whole, each single...

CVE-2009-3462: Undefined Security Weakness

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 on Unix, when Debug mode is enabled, allow attackers to execute arbitrary code via unspecified vectors, related to a "format bug."...

CVE-2009-2987: Undefined Security Weakness

Unspecified vulnerability in an ActiveX control in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 on Windows allows remote attackers to cause a denial of service via unknown vectors...

CVE-2009-2992: Improper Input Validation

An unspecified ActiveX control in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 does not properly validate input, which allows attackers to cause a denial of service via unknown vectors...

CVE-2009-3458: Improper Input Validation

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2998...

CVE-2009-2979: Undefined Security Weakness

Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 do not properly perform XMP-XML entity expansion, which allows remote attackers to cause a denial of service via a crafted document...

CVE-2009-2993: Improper Input Validation

The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the 1 Privileged Context and 2 Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and...

CVE-2009-2981: Improper Input Validation

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to bypass intended Trust Manager restrictions via unspecified vectors...

CVE-2009-2994: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via unspecified vectors...

CVE-2009-2997: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via unspecified vectors...

CVE-2009-2982: Undefined Security Weakness

An unspecified certificate in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow remote attackers to conduct a "social engineering attack" via unknown vectors...

CVE-2009-2990: Undefined Security Weakness

Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to execute arbitrary code via unspecified vectors...

CVE-2009-2991: Undefined Security Weakness

Unspecified vulnerability in the Mozilla plug-in in Adobe Reader and Acrobat 8.x before 8.1.7, and possibly 7.x before 7.1.4 and 9.x before 9.2, might allow remote attackers to execute arbitrary code via unknown vectors...

CVE-2009-2986: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrary code via unspecified vectors...

CVE-2009-2980: Undefined Security Weakness

Integer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors...

CVE-2009-2985: Undefined Security Weakness

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allow attackers to cause a denial of service memory corruption or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2996...

CVE-2009-2996: Undefined Security Weakness

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allow attackers to cause a denial of service memory corruption or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-2985...

CVE-2009-2998: Improper Input Validation

Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-3458...

RedHat Security Advisory RHSA-2009:1499

The remote host is missing updates announced in advisory RHSA-2009:1499. Adobe Reader allows users to view and print documents in Portable Document Format PDF. Multiple flaws were discovered in Adobe Reader. A specially-crafted PDF file could cause Adobe Reader to crash or, potentially, execute...

CVE-2009-2983: Undefined Security Weakness

Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 allow attackers to cause a denial of service memory corruption or possibly execute arbitrary code via unspecified vectors...