Skip to content
Fencer Vulns
high 7.5

CVE-2007-0046 in the critical feed json

Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to e…

published 2007-01-03 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0050

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
56.8%
EPSS 56.8% chance of exploitation in 30 days, percentile 99%
public exploits
1
Exploit-DB

Summary

Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.

Patch / fix

  • acroread RHEL 3 EXTRAS 7.0.9-1.1.1.EL3
  • acroread-plugin RHEL 3 EXTRAS 7.0.9-1.1.1.EL3
  • acroread-libs-atk RHEL 3 EXTRAS 1.8.0-1.el3
  • acroread-libs-gtk2 RHEL 3 EXTRAS 2.4.13-1.el3
  • acroread-libs-glib2 RHEL 3 EXTRAS 2.4.7-1
  • acroread-libs-pango RHEL 3 EXTRAS 1.6.0-1.el3
  • acroread-libs-gtk2-engines RHEL 3 EXTRAS 2.2.0-1.el3
  • acroread RHEL 4 EXTRAS 7.0.9-1.2.0.EL4

red hat advisories RHSA-2007:0021RHSA-2007:0017

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2007-0046 updated

security flaw

  • Red Hat Desktop version 3 Extras acroread 7.0.9-1.1.1.EL3, acroread-libs-glib2 2.4.7-1, acroread-libs-atk 1.8.0-1.el3, acroread-libs-gtk2 2.4.13-1.el3, acroread-libs-pango 1.6.0-1.el3, acroread-plugin 7.0.9-1.1.1.EL3, +1 more
    fixed: vendor fix RHSA-2007:0021
  • Red Hat Desktop version 4 Extras acroread 7.0.9-1.2.0.EL4, acroread-plugin 7.0.9-1.2.0.EL4
    fixed: vendor fix RHSA-2007:0017
  • Red Hat Enterprise Linux AS version 3 Extras acroread 7.0.9-1.1.1.EL3, acroread-libs-glib2 2.4.7-1, acroread-libs-atk 1.8.0-1.el3, acroread-libs-gtk2 2.4.13-1.el3, acroread-libs-pango 1.6.0-1.el3, acroread-plugin 7.0.9-1.1.1.EL3, +1 more
    fixed: vendor fix RHSA-2007:0021
  • Red Hat Enterprise Linux AS version 4 Extras acroread 7.0.9-1.2.0.EL4, acroread-plugin 7.0.9-1.2.0.EL4
    fixed: vendor fix RHSA-2007:0017
  • Red Hat Enterprise Linux ES version 3 Extras acroread 7.0.9-1.1.1.EL3, acroread-libs-glib2 2.4.7-1, acroread-libs-atk 1.8.0-1.el3, acroread-libs-gtk2 2.4.13-1.el3, acroread-libs-pango 1.6.0-1.el3, acroread-plugin 7.0.9-1.1.1.EL3, +1 more
    fixed: vendor fix RHSA-2007:0021
  • Red Hat Enterprise Linux ES version 4 Extras acroread 7.0.9-1.2.0.EL4, acroread-plugin 7.0.9-1.2.0.EL4
    fixed: vendor fix RHSA-2007:0017
  • Red Hat Enterprise Linux WS version 3 Extras acroread 7.0.9-1.1.1.EL3, acroread-libs-glib2 2.4.7-1, acroread-libs-atk 1.8.0-1.el3, acroread-libs-gtk2 2.4.13-1.el3, acroread-libs-pango 1.6.0-1.el3, acroread-plugin 7.0.9-1.1.1.EL3, +1 more
    fixed: vendor fix RHSA-2007:0021
  • Red Hat Enterprise Linux WS version 4 Extras acroread 7.0.9-1.2.0.EL4, acroread-plugin 7.0.9-1.2.0.EL4
    fixed: vendor fix RHSA-2007:0017

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-3084)

Exploit prediction

56.79% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-3084 Adobe Acrobat Reader Plugin 7.0.x - 'acroreader' Cross-Site Scripting remote, 2007-01-05
  • wisec.it http://www.wisec.it/vulns.php?page=9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.