(SYS-CON Media) – Adobe confirmed this week that a cross-site scripting (XSS) vulnerability in versions 7.0.8 and earlier of Adobe Reader and Acrobat could allow remote attackers to inject arbitrary JavaScript into a browser session. Exploitability depends on the browser and browser version being used, but upgrading to Reader 8 and Acrobat 8 "addresses the issue immediately," says Adobe.

For users who cannot upgrade to Reader 8, says the company, the Secure Software Engineering team is working with the Adobe Reader Engineering team on a 7.0.9 update to versions 7.0.8 and earlier of Adobe Reader and Acrobat that will resolve this issue, which is expected to be available in the next week.

Adobe adds that a security bulletin will be published on http://www.adobe.com/support/security "as soon as that update is available." In the meantime, Acrobat and Reader customers who cannot upgrade can use their browser preferences to disable the Acrobat and Reader plugins from opening within the browser.

All documented security vulnerabilities and their solutions are distributed through the Adobe security notification service. SYS-CON readers can sign up for the service at the following URL: http://www.adobe.com/cfusion/entitlement/index.cfm?e=szalert.