4.3

CVE-2007-0045

Exploit
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Acrobat Editionelements Version <= 7.0.8
Adobe ≫ Acrobat Version7.0 Editionprofessional
Adobe ≫ Acrobat Version7.0 Editionstandard
Adobe ≫ Acrobat Version7.0.1 Editionprofessional
Adobe ≫ Acrobat Version7.0.1 Editionstandard
Adobe ≫ Acrobat Version7.0.2 Editionprofessional
Adobe ≫ Acrobat Version7.0.2 Editionstandard
Adobe ≫ Acrobat Version7.0.3 Editionprofessional
Adobe ≫ Acrobat Version7.0.3 Editionstandard
Adobe ≫ Acrobat Version7.0.4 Editionprofessional
Adobe ≫ Acrobat Version7.0.4 Editionstandard
Adobe ≫ Acrobat Version7.0.5 Editionprofessional
Adobe ≫ Acrobat Version7.0.5 Editionstandard
Adobe ≫ Acrobat Version7.0.6 Editionprofessional
Adobe ≫ Acrobat Version7.0.6 Editionstandard
Adobe ≫ Acrobat Version7.0.7 Editionprofessional
Adobe ≫ Acrobat Version7.0.7 Editionstandard
Adobe ≫ Acrobat Version7.0.8 Editionprofessional
Adobe ≫ Acrobat Version7.0.8 Editionstandard
Adobe ≫ Acrobat Reader Version <= 7.0.8
Adobe ≫ Acrobat Reader Version6.0
Adobe ≫ Acrobat Reader Version6.0.1
Adobe ≫ Acrobat Reader Version6.0.2
Adobe ≫ Acrobat Reader Version6.0.3
Adobe ≫ Acrobat Reader Version6.0.4
Adobe ≫ Acrobat Reader Version6.0.5
Adobe ≫ Acrobat Reader Version7.0
Adobe ≫ Acrobat Reader Version7.0.1
Adobe ≫ Acrobat Reader Version7.0.2
Adobe ≫ Acrobat Reader Version7.0.3
Adobe ≫ Acrobat Reader Version7.0.4
Adobe ≫ Acrobat Reader Version7.0.5
Adobe ≫ Acrobat Reader Version7.0.6
Adobe ≫ Acrobat Reader Version7.0.7
Adobe ≫ Acrobat Reader Version7.0.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 45.26% 0.986
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
http://secunia.com/advisories/24457
Vendor Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
http://secunia.com/advisories/23691
Vendor Advisory
http://secunia.com/advisories/23812
Vendor Advisory
http://secunia.com/advisories/23877
Vendor Advisory
http://secunia.com/advisories/23882
Vendor Advisory
http://secunia.com/advisories/24533
Vendor Advisory
http://security.gentoo.org/glsa/glsa-200701-16.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1
http://www.adobe.com/support/security/bulletins/apsb07-01.html
http://www.redhat.com/support/errata/RHSA-2007-0021.html
http://www.vupen.com/english/advisories/2007/0957
Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2007-0017.html
http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
http://securityreason.com/securityalert/2090
http://securitytracker.com/id?1017469
http://www.securityfocus.com/archive/1/455801/100/0/threaded
http://www.securityfocus.com/bid/21858
http://www.vupen.com/english/advisories/2007/0032
Vendor Advisory
http://www.wisec.it/vulns.php?page=9
Patch
Exploit
http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html
http://secunia.com/advisories/23483
Vendor Advisory
http://secunia.com/advisories/33754
Vendor Advisory
http://securitytracker.com/id?1023007
http://www.adobe.com/support/security/advisories/apsa07-01.html
Vendor Advisory
http://www.adobe.com/support/security/advisories/apsa07-02.html
http://www.adobe.com/support/security/bulletins/apsb09-15.html
http://www.disenchant.ch/blog/hacking-with-browser-plugins/34
Exploit
http://www.gnucitizen.org/blog/danger-danger-danger/
Vendor Advisory
Exploit
http://www.gnucitizen.org/blog/universal-pdf-xss-after-party
http://www.kb.cert.org/vuls/id/815960
Third Party Advisory
US Government Resource
http://www.securityfocus.com/archive/1/455790/100/0/threaded
Exploit
http://www.securityfocus.com/archive/1/455800/100/0/threaded
http://www.securityfocus.com/archive/1/455831/100/0/threaded
Exploit
http://www.securityfocus.com/archive/1/455836/100/0/threaded
http://www.securityfocus.com/archive/1/455906/100/0/threaded
http://www.us-cert.gov/cas/techalerts/TA09-286B.html
US Government Resource
http://www.vupen.com/english/advisories/2009/2898
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/31271
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693