Description
Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the browser to make unauthorized requests to other web sites via a URL in the (1) FDF, (2) xml, and (3) xfdf AJAX request parameters, following the # (hash) character, aka "Universal CSRF and session riding."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | acroread +1 | 8.1.2-1.el5.3 | RHSA-2008:0144 |
| RHEL 4 | acroread +1 | 8.1.2-1.el4.2 | RHSA-2008:0144 |
| RHEL 3 | acroread +1 | 8.1.2-1.el3.6 | RHSA-2008:0144 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Adobe Reader 9.1.3 Plugin - Cross-Site Scripting EDB-29383 · remote · Jan 3, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2008:0144 Red Hat Security Advisory: acroread security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 21858 vdb-entry
- http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
- 23882 third-party-advisory
- 20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities mailing-list
- ADV-2007-0032 vdb-entry
- 2090 third-party-advisory
- SUSE-SA:2007:011 vendor-advisory
- 23812 third-party-advisory
- 1017469 vdb-entry
- oval:org.mitre.oval:def:10042 vdb-entry signature
- adobe-acrobat-pdf-csrf(31266) vdb-entry
- 29065 third-party-advisory
- GLSA-200701-16 vendor-advisory
- RHSA-2008:0144 vendor-advisory
- http://www.wisec.it/vulns.php?page=9