Actively exploited · Published Feb 12, 2008 · Assigned by mitre
CVE-2007-5659
High 7.8 Exploited
In plain English
A high-severity buffer overflow in Acrobat and Reader from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 87.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 22, 2022.
Official description
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- TA08-043A third-party-advisory, x_refsource_CERT
- http://www.adobe.com/support/security/bulletins/apsb08-13.html x_refsource_CONFIRM
- ADV-2008-1966 vdb-entry, x_refsource_VUPEN
- 20080208 Adobe Reader and Acrobat Multiple Stack-based Buffer Overflow Vulnerabilities third-party-advisory, x_refsource_IDEFENSE
- oval:org.mitre.oval:def:9813 vdb-entry, signature, x_refsource_OVAL
- http://www.adobe.com/support/security/advisories/apsa08-01.html x_refsource_CONFIRM
- 239286 vendor-advisory, x_refsource_SUNALERT
- GLSA-200803-01 vendor-advisory, x_refsource_GENTOO
- 29065 third-party-advisory, x_refsource_SECUNIA
- 30840 third-party-advisory, x_refsource_SECUNIA
- 29205 third-party-advisory, x_refsource_SECUNIA
- RHSA-2008:0144 vendor-advisory, x_refsource_REDHAT
- VU#666281 third-party-advisory, x_refsource_CERT-VN
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-5659 government-resource