Two more zero-day flaws have been found in Adobe Reader that could lead to users' machines being compromised.
The flaws, which versions of the software on all operating systems, concern the Javascript processing function in Adobe Reader. Exploiting either flaw could allow arbitrary code to be executed on a victim's machine. According to a Secunia advisory, they were discovered by a security researcher going by the nickname Arr1val.
The first flaw involves an error when processing calls to the getAnnots() Javascript method, which could be used to corrupt memory. The second flaw, which could also corrupt memory, can be invoked by using the customDictionaryOpen() command.
Adobe's PSIRT blog confirmed that the vulnerability applied to more than just the Linux versions of its software, which is the operating system on which they were originally discovered. "All currently supported shipping versions of Adobe Reader and Acrobat (Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are vulnerable to this issue," it said. "Adobe plans to provide updates for all affected versions for all platforms (Windows, Macintosh and Unix) to resolve this issue."
However, it did not give a projected release date for a patch resolving the issue, instead saying that it was working on a timeline.
Last November, a flaw was found which again allowed the execution of arbitrary code, this time through the util.printf Javascript function. That vulnerability was said to have been exploited in the wild after researchers found specially rigged PDFs online.