CVE-2013-5325

Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF…

published October 9, 2013

CVSS
—
EPSS
4%
Percentile
89.5
In the wild
Unconfirmed
What it is

⚠️ Just a crafty PDF is all an attacker needs! Adobe Reader and Acrobat versions before 11.0.05 can execute arbitrary JavaScript, turning a trusted document into a sneaky trap. 🔥 Imagine receiving a seemingly harmless envelope in the mail, but inside, it contains instructions to access your locked vault without your permission. This vulnerability allows attackers to hide malicious JavaScript within a PDF, bypassing your defenses completely! If an attacker exploits this vulnerability, they could execute any JavaScript code on your machine, leading to data theft, system compromise, or worse! It’s like giving a stranger the keys to your digital house without realizing it.

Put simply

Imagine receiving a seemingly harmless envelope in the mail, but inside, it contains instructions to access your locked vault without your permission. This vulnerability allows attackers to hide malicious JavaScript within a PDF, bypassing your defenses completely! This flaw in Adobe Reader and Acrobat allows attackers to inject malicious JavaScript code through specially crafted PDF files, which are processed without adequate security checks.

What to do

If an attacker exploits this vulnerability, they could execute any JavaScript code on your machine, leading to data theft, system compromise, or worse! It’s like giving a stranger the keys to your digital house without realizing it. Upgrade Adobe Reader and Acrobat to version 11.0.05 or later to close this door to attackers. Review your PDF handling practices and consider setting stricter permissions for executing JavaScript in documents. You've got this! Stay proactive and secure your PDFs like a true security hero! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03641 · 89.5th percentile
Published
2013-10-09T14:44Z
EPSS history
Timeline
  • 09 OCT 14:44Z
    Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF…
    cvelistv5