Multiple Remote Code Execution Vulnerabilities in SlimPDF Reader

Release date: 2011-10-03
Updated on: 2011-11-04

Affected Systems:
Investintech SlimPDF Reader
Investintech Absolute PDF Server
Investintech Able2Extract Server
Investintech Able2Doc
Description:
--------------------------------------------------------------------------------
Bugtraq id: 49923
Cve id: CVE-2011-4216, CVE-2011-4217, CVE-2011-4218, CVE-2011-4219, CVE-2011-4220, CVE-2011-4221, CVE-2011-4222

SlimPDF Reader is a lightweight and free PDF Reader with a size of 1 MB. It provides a complete PDF reading function and supports scaling, rotation, navigation control, and search.

SlimPDF Reader has multiple Implementation Vulnerabilities. Remote unauthenticated attackers can exploit these vulnerabilities to trick users into opening special. pdf files to execute arbitrary code.

<* Source: Carlos Mario Penagos Holmann

Link: http://www.kb.cert.org/vuls/id/275036
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Investintech
------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.investintech.com/prod_options.htm