Description
Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | mozilla-firefox | 1.0.4-2sarge17 | DSA-1336-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | acroread +1 | 7.0.9-1.2.0.EL4 | RHSA-2007:0017 |
| RHEL 3 | acroread +1 | 7.0.9-1.1.1.EL3 | RHSA-2007:0021 |
| RHEL 3 | acroread-libs-atk | 1.8.0-1.el3 | RHSA-2007:0021 |
| RHEL 3 | acroread-libs-glib2 | 2.4.7-1 | RHSA-2007:0021 |
| RHEL 3 | acroread-libs-gtk2 | 2.4.13-1.el3 | RHSA-2007:0021 |
| RHEL 3 | acroread-libs-gtk2-engines | 2.2.0-1.el3 | RHSA-2007:0021 |
| RHEL 3 | acroread-libs-pango | 1.6.0-1.el3 | RHSA-2007:0021 |
Advisories 3
- RHSA-2007:0017 Red Hat Security Advisory: Adobe Acrobat Reader security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0021 Red Hat Security Advisory: Adobe Acrobat Reader security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1336-1 mozilla-firefox Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2007:0021 vendor-advisory
- 23691 third-party-advisory
- TA09-286B third-party-advisory
- RHSA-2007:0017 vendor-advisory
- 21858 vdb-entry
- http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html
- http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
- 20070103 Universal XSS with PDF files: highly dangerous mailing-list
- 1023007 vdb-entry
- 23882 third-party-advisory
- 20070103 Adobe Acrobat Reader Plugin - Multiple Vulnerabilities mailing-list
- ADV-2007-0032 vdb-entry
- 24457 third-party-advisory
- HPSBUX02153 vendor-advisory
- adobe-acrobat-pdf-xss(31271) vdb-entry
- 20070103 Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous mailing-list
- http://www.adobe.com/support/security/bulletins/apsb09-15.html
- http://www.mozilla.org/security/announce/2007/mfsa2007-02.html
- 2090 third-party-advisory
- SUSE-SA:2007:011 vendor-advisory
- 102847 vendor-advisory
- 33754 third-party-advisory
- ADV-2007-0957 vdb-entry
- 20070103 RE: [WEB SECURITY] Universal XSS with PDF files: highly dangerous mailing-list
- 23812 third-party-advisory
- 20070104 Universal PDF XSS After Party mailing-list
- 1017469 vdb-entry
- http://www.adobe.com/support/security/advisories/apsa07-01.html
- http://www.adobe.com/support/security/advisories/apsa07-02.html
- 23483 third-party-advisory
- 23877 third-party-advisory
- http://www.gnucitizen.org/blog/universal-pdf-xss-after-party
- http://www.adobe.com/support/security/bulletins/apsb07-01.html
- oval:org.mitre.oval:def:9693 vdb-entry signature
- oval:org.mitre.oval:def:6487 vdb-entry signature
- ADV-2009-2898 vdb-entry
- http://www.gnucitizen.org/blog/danger-danger-danger/
- GLSA-200701-16 vendor-advisory
- 24533 third-party-advisory
- http://www.disenchant.ch/blog/hacking-with-browser-plugins/34
- SSA:2007-066-05 vendor-advisory
- VU#815960 third-party-advisory
- 20070103 Re: Universal XSS with PDF files: highly dangerous mailing-list
- http://www.wisec.it/vulns.php?page=9