Adobe to patch Reader zero-day bug Thursday

From InfoWorld: Adobe Systems said today that it would patch a critical Reader vulnerability on Thursday.

Two weeks ago, Adobe had promised to fix the flaw during the week of Aug. 16 with an emergency, or "out-of-band" security update, but had not slated a specific date. Computerworld had pegged the likely release date as Aug. 17 based on past Adobe practice of issuing many of its security updates on Tuesdays.

The bug Adobe plans to patch was disclosed by researcher Charlie Miller at last month's Black Hat security conference, when he demonstrated how the open-source BitBlaze toolkit could be used to boost bug-hunting productivity.

Miller, an analyst with Baltimore-based Independent Security Evaluators, is well-known for finding vulnerabilities in Adobe's popular Reader PDF viewer. Last March, Miller showed how a simple fuzzing tool could root out scores of potential bugs in Reader and other software.

Miller said the vulnerability is in Reader's and Acrobat's font parsing, but is not connected with the PDF font parsing flaw exploited by hackers to "jailbreak" Apple's iOS 4 earlier this month. Apple patched the font vulnerability last Wednesday.

View: Article @ Source Site