Nortel Response to Adobe Vulnerability Identifier APSB08-19
| Description: |
Adobe has recently released a Security Update for Adobe Reader 8 and Acrobat 8. Some Nortel products contain this software as a component and thus are potentially affected by the vulnerabilities addressed. This bulletin provides a multi-product consolidated response for the Nortel products which are potentially affected. The Adobe Summary states that critical vulnerabilities have been identified in Adobe Reader and Acrobat 8.1.2 and earlier versions. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system. In addition, Adobe Reader 9 and Acrobat 9 are not vulnerable to these issues. Adobe recommends users of Acrobat 8 and Adobe Reader 8 who can't update to Adobe Reader 9 install the 8.1.3 update to protect themselves from potential vulnerabilities This bulletin addresses the following CVEs: 1. CVE-2008-2549 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2549) Adobe Acrobat Reader 8.1.2 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed PDF document, as demonstrated by 2008-HI2.pdf. 2. CVE-2008-2992 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2992) Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104. 3. CVE-2008-4812 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4812) Array index error in Adobe Reader and Acrobat, and the Explorer extension (aka AcroRd32Info), 8.1.2, 8.1.1, and earlier allows remote attackers to execute arbitrary code via a crafted PDF document that triggers an out-of-bounds write, related to parsing of Type 1 fonts. 4. CVE-2008-4813 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4813) Adobe Reader and Acrobat 8.1.2 and earlier allow re |
| Type: |
Security Advisories |
| Number: |
2008009218, Rev 1 |
| Status: |
Retired |
| Date: |
2009-06-24 |
