Adobe Reader 8 contains multiple input validation errors in a JavaScript method. According to Adobe these flaws could result in arbitrary code execution with the permissions of the user running Adobe Reader.
Public now via upstream security bulletin: http://www.adobe.com/support/security/bulletins/apsb08-19.html CVE description: Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 allows remote attackers to execute arbitrary code via a PDF file containing a crafted format string in the util.printf JavaScript functio Further details about this flaw can be found in the advisories from: Secunia: http://secunia.com/secunia_research/2008-14/ http://marc.info/?l=full-disclosure&m=122581373919195&w=4 Core Security Technologies: http://www.coresecurity.com/content/adobe-reader-buffer-overflow http://marc.info/?l=full-disclosure&m=122581551023416&w=4
Issue is also covered by ZDI: http://www.zerodayinitiative.com/advisories/ZDI-08-072/ http://marc.info/?l=full-disclosure&m=122583328628340&w=4
This issue was addressed in: Red Hat Enterprise Linux Extras: http://rhn.redhat.com/errata/RHSA-2008-0974.html