CVE-2007-0045
Summary
| CVE | CVE-2007-0045 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-01-03 21:28:00 UTC |
| Updated | 2018-10-16 16:30:00 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)." |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Adobe | Acrobat | 7.0 | All | professional | All |
| Application | Adobe | Acrobat | 7.0 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.1 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.1 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.2 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.2 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.3 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.3 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.4 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.4 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.5 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.5 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.6 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.6 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.7 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.7 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.8 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.8 | All | standard | All |
| Application | Adobe | Acrobat | 7.0 | All | professional | All |
| Application | Adobe | Acrobat | 7.0 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.1 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.1 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.2 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.2 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.3 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.3 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.4 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.4 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.5 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.5 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.6 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.6 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.7 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.7 | All | standard | All |
| Application | Adobe | Acrobat | 7.0.8 | All | professional | All |
| Application | Adobe | Acrobat | 7.0.8 | All | standard | All |
| Application | Adobe | Acrobat | All | All | elements | All |
| Application | Adobe | Acrobat 3d | All | All | All | All |
| Application | Adobe | Acrobat 3d | All | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.1 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.2 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.3 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.4 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.5 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.1 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.2 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.3 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.4 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.5 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.6 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.7 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.8 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.1 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.2 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.3 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.4 | All | All | All |
| Application | Adobe | Acrobat Reader | 6.0.5 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.1 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.2 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.3 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.4 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.5 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.6 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.7 | All | All | All |
| Application | Adobe | Acrobat Reader | 7.0.8 | All | All | All |
| Application | Adobe | Acrobat Reader | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| The Slackware Linux Project: Slackware Security Advisories | SLACKWARE | slackware.com | |
| rhn.redhat.com | Red Hat Support | REDHAT | rhn.redhat.com | |
| Google Chrome Cross-Site Scripting and Information Disclosure - Advisories - Community | SECUNIA | secunia.com | Vendor Advisory |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| Wisec - The WIse SECurity | MISC | www.wisec.it | Exploit, Patch |
| US-CERT Vulnerability Note VU#815960 | CERT-VN | www.kb.cert.org | Third Party Advisory, US Government Resource |
| Universal PDF XSS After Party | GNUCITIZEN | MISC | www.gnucitizen.org | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | Exploit |
| Adobe - Security Advisories : Update available for vulnerabilities in versions 7.0.8 and earlier of Adobe Reader and Acrobat | CONFIRM | www.adobe.com | |
| MFSA 2007-02: Improvements to help protect against Cross-Site Scripting attacks | CONFIRM | www.mozilla.org | |
| Adobe Acrobat Reader: Multiple vulnerabilities — Gentoo Linux Documentation | GENTOO | security.gentoo.org | |
| rhn.redhat.com | Red Hat Support | REDHAT | www.redhat.com | |
| 102847 | SUNALERT | sunsolve.sun.com | |
| Slackware update for seamonkey - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| Google Chrome Releases: Stable, Beta update: Yahoo! Mail and Security Fixes | CONFIRM | googlechromereleases.blogspot.com | |
| Red Hat update for acroread - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| Sun Solaris Adobe Acrobat Multiple Vulnerabilities - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| US-CERT Technical Cyber Security Alert TA09-286B -- Adobe Reader and Acrobat Vulnerabilities | CERT | www.us-cert.gov | US Government Resource |
| SecurityTracker.com Archives - Adobe Acrobat and Adobe Reader Flaws Lets Remote Users Execute Arbitrary Code and Deny Service | SECTRACK | securitytracker.com | |
| SecurityReason - Adobe Acrobat Reader Plugin - Multiple Vulnerabilities | SREASON | securityreason.com | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| Adobe Reader Plugin Open Parameters Cross-Site Scripting Vulnerability | BID | www.securityfocus.com | |
| SUSE update for acroread - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| Hacking with Browser Plugins at Disenchant’s Blog | MISC | www.disenchant.ch | Exploit |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| HPSBUX02153 SSRT061181 rev.7 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial of Service (DoS) - c00771742 - HP Business Support Center | HP | h20000.www2.hp.com | |
| Adobe - Security Bulletin APSB09-15 Security Updates Available for Adobe Reader and Acrobat | CONFIRM | www.adobe.com | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| Red Hat update for acroread - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| Gentoo update for acroread - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| About Secunia Research | Flexera | SECUNIA | secunia.com | Vendor Advisory |
| DANGER, DANGER, DANGER | GNUCITIZEN | CONFIRM | www.gnucitizen.org | Exploit, Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Adobe - Cross-site scripting vulnerability in versions 7.0.8 and earlier of Adobe Reader and Acrobat | CONFIRM | www.adobe.com | Vendor Advisory |
| SecurityTracker.com Archives - Adobe Acrobat Reader Plugin Bugs Let Remote Users Deny Service, Conduct Cross-Site Scripting Attacks, and Execute Arbitrary Code | SECTRACK | securitytracker.com | |
| Adobe - Server-side workarounds to prevent potential cross-site scripting vulnerability in versions 7.0.8 and earlier of Adobe Reader and Acrobat | CONFIRM | www.adobe.com | |
| SecurityFocus | BUGTRAQ | www.securityfocus.com | Exploit |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf | MISC | events.ccc.de | |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | |
| SuSE Security announcements: [suse-security-announce] SUSE Security Announcement: Acrobat Reader 7.0.9 (SUSE-SA:2007:011) | SUSE | lists.suse.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.