VMware, Adobe vulnerabilities disclosed

The 13 "highly critical" flaws affecting ESX Server versions 2 and 3, VMware's hypervisor-based virtualisation solution, could be remotely exploited to cause a DoS attack or system compromise, according to a Secunia advisory.

Another five, less severe bugs impact related software, including the VMware Workstation, Server ACE and Player products, according to a separate Secunia advisory. The flaws, drawing a "moderately critical" rating, can be used in privilege escalation and DoS attacks.

Meanwhile, the same researcher who discovered the QuickTime-Firefox flaw that was patched this week, today disclosed a "high-risk vulnerability" affecting Adobe Acrobat and Reader.

"All it takes is to open a PDF document or stumble across a page which embeds one," Petko D. Petkov said on his Gnucitizen website. "The issue is quite critical given the fact that PDF documents are in the core of today's modern business."

He said the vulnerability was identified on Windows XP using the latest Adobe Reader version. Petkov added that he does not plan to publish proof-of-concept code – as he did in the case of the QuickTime flaw – because Adobe produces closed-source software.

An Adobe spokesperson could not be immediately reached for comment.

See original article on SC Magazine US

Copyright © SC Magazine, US edition

adobedisclosedsecurityvmwarevulnerabilities