Adobe plugs Reader and Acrobat security holes

The Adobe flaws left systems open to remote code execution

Adobe has issued an update to fix critical security vulnerabilities in its Reader and Acrobat applications.

The company said in a security advisory that a critical vulnerability has been identified in Adobe Reader 9.3 for Windows, Mac and Unix, Adobe Acrobat 9.3 for Windows and Mac, and Adobe Reader 8.2 and Acrobat 8.2 for Windows and Mac.

The vulnerabilities could be used to subvert domain sandboxing, letting an unauthorised user make a cross domain request and effectively gain control of the system. A further critical vulnerability could cause systems to crash.

Users are advised to update to Adobe Acrobat 9.3.1 and Adobe Reader 9.3.1 immediately.

Adobe warned of the problems last week, and promised to release a patch by today. However, this has meant that a number of users have been unprotected during this period.

The company usually issues security updates on a quarterly basis.