Didier Stevens

**Name of the Vulnerable Software and Affected Versions** Adobe Reader and Acrobat versions 9.x prior to 9.3.3 Adobe Reader and Acrobat versions 8.x prior to 8.2.3 **Description** The issue allows remote attackers to trick users into executing an arbitrary local program specified in a PDF document. This is due to the lack of restriction on the contents of a text field in the Launch File warning dialog, making it easier for attackers to deceive users. The vulnerability can be exploited by a specially crafted PDF file, potentially allowing a remote attacker to execute arbitrary code. **Recommendations** For Adobe Reader and Acrobat versions 9.x prior to 9.3.3, update to version 9.3.3 or later. For Adobe Reader and Acrobat versions 8.x prior to 8.2.3, update to version 8.2.3 or later.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader versions prior to 3.2.1.0401 **Description** The issue allows remote attackers to execute arbitrary local programs via a certain "/Type /Action /S /Launch" sequence, and execute arbitrary programs embedded in a PDF document via an unspecified "/Launch /Action" sequence. **Recommendations** For versions prior to 3.2.1.0401, update to version 3.2.1.0401 or later to resolve the issue.