N/A

Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content."

N/A

N/A

Mozilla Firefox Adobe Acrobat JavaScript访问控制绕过漏洞

Mozilla Firefox是一个免费开放源码的Web浏览器。 Mozilla Firefox执行对一个javascript的响应的DOM调用：包含于内嵌PDF文件的一个格式中的提交元素的目标属性中的URI,可能允许远程攻击者绕过在文件对象上预设的Adobe Acrobat JavaScript限制，这表现目标属性的URI通过一个网站，允许不可信用户上传PDF格式文件的网站和此JavaScript：URI的共享document.domain。注意：研究人员报告说，Adobe公司的立场是"一个PDF文件就

N/A

N/A