[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Secunia Research: Adobe Reader JBIG2 Symbol Dictionary Buffer Overflow
Dear Eric C. Lukens,
US-CERT note TA09-051A on this issue beeing exploited in-the-wild was
issued on February, 20.
--Wednesday, March 25, 2009, 10:20:40 PM, you wrote to bugtraq@xxxxxxxxxxxxxxxxx:
ECL> I noticed that as well, but suspected they were notified via more then
ECL> one mechanism or had already found the bug internally. I find it funny
ECL> that they had the final code ready on the 28th, but still didn't get it
ECL> out to the public for another 2 weeks. I suppose they ran it through
ECL> one last QA procedure, or they just don't like to deliver things early.
ECL> -------- Original Message --------
ECL> Subject: Re: Secunia Research: Adobe Reader JBIG2 Symbol Dictionary
ECL> Buffer Overflow
ECL> From: Florian Weimer <fw@xxxxxxxxxxxxx>
ECL> To: Secunia Research <remove-vuln@xxxxxxxxxxx>
ECL> Cc: bugtraq@xxxxxxxxxxxxxxxxx
ECL> Date: 3/25/09 11:42 AM
>> * Secunia Research:
>>> 5) Solution
>>> Update to version 7.1.1, 8.1.4, or 9.1.
>>> 6) Time Table
>>> 06/03/2009 - Vendor notified.
>>> 07/03/2009 - Vendor response.
>>> 25/03/2009 - Public disclosure.
>> Something doesn't add up because the 9.1 binary I've got was created
>> on February 28th, according to Verisign's time stamping signature in
>> the Authenticode signature.