RHEL 3 / 4 / 5 : acroread (RHSA-2008:0144)

high Nessus Plugin ID 40715


The remote Red Hat host is missing one or more security updates.


Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Adobe Reader allows users to view and print documents in portable document format (PDF).

Several flaws were found in the way Adobe Reader processed malformed PDF files. An attacker could create a malicious PDF file which could execute arbitrary code if opened by a victim. (CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0726)

A flaw was found in the way the Adobe Reader browser plug-in honored certain requests. A malicious PDF file could cause the browser to request an unauthorized URL, allowing for a cross-site request forgery attack. (CVE-2007-0044)

A flaw was found in Adobe Reader's JavaScript API DOC.print function.
A malicious PDF file could silently trigger non-interactive printing of the document, causing multiple copies to be printed without the users consent. (CVE-2008-0667)

Additionally, this update fixes multiple unknown flaws in Adobe Reader. When the information regarding these flaws is made public by Adobe, it will be added to this advisory. (CVE-2008-0655)

Note: Adobe have yet to release security fixed versions of Adobe 7.
All users of Adobe Reader are, therefore, advised to install these updated packages. They contain Adobe Reader version 8.1.2, which is not vulnerable to these issues.


Update the affected acroread and / or acroread-plugin packages.

See Also









Plugin Details

Severity: High

ID: 40715

File Name: redhat-RHSA-2008-0144.nasl

Version: 1.31

Type: local

Agent: unix

Published: 8/24/2009

Updated: 6/8/2022

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information


Risk Factor: Critical

Score: 9.6


Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2008-0726

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:acroread, p-cpe:/a:redhat:enterprise_linux:acroread-plugin, cpe:/o:redhat:enterprise_linux:3, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:4.6, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:5.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/22/2008

Vulnerability Publication Date: 1/3/2007

CISA Known Exploited Vulnerability Due Dates: 6/22/2022

Exploitable With


Core Impact

Metasploit (Adobe Collab.collectEmailInfo() Buffer Overflow)

Reference Information

CVE: CVE-2007-0044, CVE-2007-5659, CVE-2007-5663, CVE-2007-5666, CVE-2008-0655, CVE-2008-0667, CVE-2008-0726

BID: 21858, 27641

CWE: 119, 189, 352, 399, 94

RHSA: 2008:0144