CVE-2007-0045

Published: Jan 3, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

Affected (36)

Products: Adobe: Acrobat, Acrobat 3d, Acrobat Reader

3 products

Configuration A

36 vulnerable

Vulnerable Software	Affected Versions
Adobe Acrobat	Up to 7.0.8
Adobe Acrobat	Version 7.0.1
Adobe Acrobat	Version 7.0.1
Adobe Acrobat	Version 7.0.2
Adobe Acrobat	Version 7.0.2
Adobe Acrobat	Version 7.0.3
Adobe Acrobat	Version 7.0.3
Adobe Acrobat	Version 7.0.4
Adobe Acrobat	Version 7.0.4
Adobe Acrobat	Version 7.0.5
Adobe Acrobat	Version 7.0.5
Adobe Acrobat	Version 7.0.6
Adobe Acrobat	Version 7.0.6
Adobe Acrobat	Version 7.0.7
Adobe Acrobat	Version 7.0.7
Adobe Acrobat	Version 7.0.8
Adobe Acrobat	Version 7.0.8
Adobe Acrobat	Version 7.0
Adobe Acrobat	Version 7.0
Adobe Acrobat 3d	All versions
Adobe Acrobat Reader	Up to 7.0.8
Adobe Acrobat Reader	Version 6.0.1
Adobe Acrobat Reader	Version 6.0.2
Adobe Acrobat Reader	Version 6.0.3
Adobe Acrobat Reader	Version 6.0.4
Adobe Acrobat Reader	Version 6.0.5
Adobe Acrobat Reader	Version 6.0
Adobe Acrobat Reader	Version 7.0.1
Adobe Acrobat Reader	Version 7.0.2
Adobe Acrobat Reader	Version 7.0.3
Adobe Acrobat Reader	Version 7.0.4
Adobe Acrobat Reader	Version 7.0.5
Adobe Acrobat Reader	Version 7.0.6
Adobe Acrobat Reader	Version 7.0.7
Adobe Acrobat Reader	Version 7.0.8
Adobe Acrobat Reader	Version 7.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (88)

http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf

Source: cve@mitre.org

http://googlechromereleases.blogspot.com/2009/01/stable-beta-update-yahoo-mail-and.html

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742

Source: cve@mitre.org

http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html

Source: cve@mitre.org

http://secunia.com/advisories/23483

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23691

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23812

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23877

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23882

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24457

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24533

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/33754

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200701-16.xml

Source: cve@mitre.org

http://securityreason.com/securityalert/2090

Source: cve@mitre.org

http://securitytracker.com/id?1017469

Source: cve@mitre.org

http://securitytracker.com/id?1023007

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102847-1

Source: cve@mitre.org

http://www.adobe.com/support/security/advisories/apsa07-01.html

Source: cve@mitre.org

Vendor Advisory

http://www.adobe.com/support/security/advisories/apsa07-02.html

Source: cve@mitre.org

http://www.adobe.com/support/security/bulletins/apsb07-01.html

Source: cve@mitre.org

http://www.adobe.com/support/security/bulletins/apsb09-15.html

Source: cve@mitre.org

http://www.disenchant.ch/blog/hacking-with-browser-plugins/34

Source: cve@mitre.org

Exploit

http://www.gnucitizen.org/blog/danger-danger-danger/

Source: cve@mitre.org

ExploitVendor Advisory

http://www.gnucitizen.org/blog/universal-pdf-xss-after-party

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/815960

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.mozilla.org/security/announce/2007/mfsa2007-02.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0021.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/455790/100/0/threaded

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/455800/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/455801/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/455831/100/0/threaded

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/455836/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/455906/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/21858

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-286B.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2007/0032

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2007/0957

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2009/2898

Source: cve@mitre.org

Vendor Advisory

http://www.wisec.it/vulns.php?page=9

Source: cve@mitre.org

ExploitPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/31271

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6487

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9693

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2007-0017.html

Source: cve@mitre.org

http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf