450078 – (CVE-2008-2549) CVE-2008-2549 acroread: crash and possible code execution

Bug 450078 (CVE-2008-2549) - CVE-2008-2549 acroread: crash and possible code execution

Summary: CVE-2008-2549 acroread: crash and possible code execution

Keywords:
Status:	CLOSED ERRATA
Alias:	CVE-2008-2549
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	urgent
Severity:	urgent
Target Milestone:	---
Assignee:	Red Hat Product Security
QA Contact:
Docs Contact:
URL:	http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:
Depends On:	469916 469917 469918
Blocks:
TreeView+	depends on / blocked

Reported:	2008-06-05 06:54 UTC by Tomas Hoger
Modified:	2019-09-29 12:24 UTC (History)
CC List:	2 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:	2008-11-13 15:35:58 UTC
Embargoed:

Attachments	(Terms of Use)
Public PoC (182.81 KB, application/pdf) 2008-06-05 06:55 UTC, Tomas Hoger	no flags	Details
View All

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2008:0974	0	normal	SHIPPED_LIVE	Critical: acroread security update	2008-11-12 17:26:33 UTC

Description Tomas Hoger 2008-06-05 06:54:03 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2549 to the following vulnerability:

Adobe Acrobat Reader 8.1.2 and earlier allows remote attackers to
cause a denial of service (application crash) and possibly execute
arbitrary code via a malformed PDF document, as demonstrated by
2008-HI2.pdf.

References:
http://www.milw0rm.com/exploits/5687
http://www.securityfocus.com/bid/29420

Comment 1 Tomas Hoger 2008-06-05 06:55:13 UTC

Created attachment 308415 [details]
Public PoC

http://www.milw0rm.com/exploits/5687
http://milw0rm.com/sploits/2008-HI2.pdf

Comment 4 Tomas Hoger 2008-11-05 08:18:22 UTC

Fixed upstream in 8.1.3:
  http://www.adobe.com/support/security/bulletins/apsb08-19.html

Comment 6 Red Hat Product Security 2008-11-13 15:35:58 UTC

This issue was addressed in:

Red Hat Enterprise Linux Extras:
  http://rhn.redhat.com/errata/RHSA-2008-0974.html

Note You need to log in before you can comment on or make changes to this bug.