Cross-Site Scripting Vulnerabilities in Adobe Acrobat Reader Plugin

CVE-2007-0045

Summary

The Adobe Acrobat Reader Plugin is vulnerable to multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary JavaScript code via a crafted .pdf URL containing malicious javascript: or res: URIs. This can lead to significant security risks through arbitrary parameter injection, including but not limited to FDF, XML, and XFDF AJAX parameters as well as specially named anchor identifiers. Users of Adobe Acrobat Reader on various browsers such as Mozilla Firefox, Microsoft Internet Explorer, Google Chrome, and Opera need to be aware of these vulnerabilities and ensure they are using updated versions to mitigate potential exploitation.

References