Adobe Reader is arguably the world's most ubiquitous electronic document sharing application. The software can be used to view, search, digitally sign, verify, print, and collaborate on Adobe PDF files, and includes scripting functionality to allow for extended customization and extensibility. Adobe Reader suffers from a stack buffer overflow when parsing specially crafted (invalid) PDF files. The vulnerability is caused due to a boundary error when parsing format strings containing a floating point specifier in the "util.printf()" JavaScript function. Successful exploitation of the vulnerability requires that users open a maliciously crafted PDF file thereby allowing attackers to gain access to vulnerable systems and assume the privileges of a user running Acrobat Reader. Adobe Reader version 9, which was released in June 2008, is not vulnerable to the reported problem. Workaround: Alternatively, a possible workaround for this vulnerability is to disable JavaScript in Adobe Reader and Acrobat (in the software's Edit/Preferences menu). Disabling JavaScript will prevent the issue, although it will also prevent many basic Acrobat and Reader workflows from properly functioning.
Version 9 is not affected, can we get it into the tree?
Sorry, for the bugspam, same as http://www.adobe.com/support/security/bulletins/apsb08-19.html *** This bug has been marked as a duplicate of bug 225483 ***
