CVE-2007-0045

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

References

http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf

http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html

http://secunia.com/advisories/23483

http://secunia.com/advisories/23691

http://secunia.com/advisories/23812

http://secunia.com/advisories/23877

http://secunia.com/advisories/23882

http://secunia.com/advisories/24457

http://secunia.com/advisories/24533

http://secunia.com/advisories/33754

http://security.gentoo.org/glsa/glsa-200701-16.xml

http://securityreason.com/securityalert/2090

http://securitytracker.com/id?1017469

http://securitytracker.com/id?1023007

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1

http://www.adobe.com/support/security/advisories/apsa07-01.html

http://www.adobe.com/support/security/advisories/apsa07-02.html

http://www.adobe.com/support/security/bulletins/apsb07-01.html

http://www.adobe.com/support/security/bulletins/apsb09-15.html

http://www.disenchant.ch/blog/hacking-with-browser-plugins/34

http://www.gnucitizen.org/blog/danger-danger-danger/

http://www.gnucitizen.org/blog/universal-pdf-xss-after-party

http://www.kb.cert.org/vuls/id/815960

http://www.mozilla.org/security/announce/2007/mfsa2007-02.html

http://www.redhat.com/support/errata/RHSA-2007-0021.html

http://www.securityfocus.com/archive/1/455790/100/0/threaded

http://www.securityfocus.com/archive/1/455800/100/0/threaded

http://www.securityfocus.com/archive/1/455801/100/0/threaded

http://www.securityfocus.com/archive/1/455831/100/0/threaded

http://www.securityfocus.com/archive/1/455836/100/0/threaded

http://www.securityfocus.com/archive/1/455906/100/0/threaded

http://www.securityfocus.com/bid/21858

http://www.us-cert.gov/cas/techalerts/TA09-286B.html

http://www.vupen.com/english/advisories/2007/0032

http://www.vupen.com/english/advisories/2007/0957

http://www.vupen.com/english/advisories/2009/2898

http://www.wisec.it/vulns.php?page=9

https://exchange.xforce.ibmcloud.com/vulnerabilities/31271

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693

https://rhn.redhat.com/errata/RHSA-2007-0017.html

Details

Source: MITRE

Published: 2007-01-03

Updated: 2018-10-16

Type: CWE-79

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:adobe:acrobat:7.0:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.1:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.1:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.2:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.2:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.3:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.3:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.4:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.4:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.5:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.5:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.6:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.6:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.7:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.7:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:*:*:elements:*:*:*:*:* versions up to 7.0.8 (inclusive)

cpe:2.3:a:adobe:acrobat:7.0.8:*:professional:*:*:*:*:*

cpe:2.3:a:adobe:acrobat:7.0.8:*:standard:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_3d:*:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:6.0:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:6.0.3:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:6.0.4:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:6.0.5:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.2:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.3:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.4:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.5:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.6:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.7:*:*:*:*:*:*:*

cpe:2.3:a:adobe:acrobat_reader:7.0.8:*:*:*:*:*:*:*

Tenable Plugins

View all (29 total)

IDNameProductFamilySeverity
107373Solaris 10 (sparc) : 121104-11NessusSolaris Local Security Checks
high
63836RHEL 3 : Adobe Acrobat Reader (RHSA-2007:0021)NessusRed Hat Local Security Checks
high
63835RHEL 4 : Adobe Acrobat Reader (RHSA-2007:0017)NessusRed Hat Local Security Checks
high
51709SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6585)NessusSuSE Local Security Checks
high
51708SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 6584)NessusSuSE Local Security Checks
high
51694SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6583)NessusSuSE Local Security Checks
high
51693SuSE 10 Security Update : Acrobat Reader (ZYPP Patch Number 6582)NessusSuSE Local Security Checks
high
42318openSUSE 10 Security Update : acroread (acroread-6588)NessusSuSE Local Security Checks
high
42251SuSE 11 Security Update : acroread_ja (SAT Patch Number 1424)NessusSuSE Local Security Checks
high
42250SuSE 11 Security Update : Acrobat Reader (SAT Patch Number 1425)NessusSuSE Local Security Checks
high
42247openSUSE Security Update : acroread (acroread-1426)NessusSuSE Local Security Checks
high
42244openSUSE Security Update : acroread (acroread-1426)NessusSuSE Local Security Checks
high
42239GLSA-200910-03 : Adobe Reader: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
42120Adobe Reader < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)NessusWindows
high
42119Adobe Acrobat < 9.2 / 8.1.7 / 7.1.4 Multiple Vulnerabilities (APSB09-15)NessusWindows
high
41117SuSE9 Security Update : acroread (YOU Patch Number 11433)NessusSuSE Local Security Checks
high
40798Adobe Acrobat < 6.0.6 / 7.0.9 Multiple VulnerabilitiesNessusWindows
high
4920Google Chrome < 1.0.154.46 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
medium
35558Google Chrome < 1.0.154.46 Multiple VulnerabilitiesNessusWindows
medium
29371SuSE 10 Security Update : acroread_ja (ZYPP Patch Number 2545)NessusSuSE Local Security Checks
high
29370SuSE 10 Security Update : acroread (ZYPP Patch Number 2508)NessusSuSE Local Security Checks
high
27144openSUSE 10 Security Update : acroread (acroread-2506)NessusSuSE Local Security Checks
high
25779Debian DSA-1336-1 : mozilla-firefox - several vulnerabilitiesNessusDebian Local Security Checks
high
24791Slackware 11.0 : seamonkey (SSA:2007-066-05)NessusSlackware Local Security Checks
high
24252GLSA-200701-16 : Adobe Acrobat Reader: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
24002Adobe Reader < 6.0.6 / 7.0.9 Multiple VulnerabilitiesNessusWindows
high
23975Adobe PDF Plug-In < 8.0 / 7.0.9 / 6.0.6 Multiple Vulnerabilities (APSB07-01)NessusWindows
high
22967Solaris 10 (sparc) : 121104-11 (deprecated)NessusSolaris Local Security Checks
high
800951Google Chrome < 1.0.154.46 Multiple VulnerabilitiesLog Correlation EngineWeb Clients
medium