Some vulnerabilities have been reported in Adobe Reader/Acrobat, which can be exploited by malicious people to compromise a user's system.

1) An array indexing error in the processing of JBIG2 streams can be exploited to corrupt arbitrary memory via a specially crafted PDF file.

Successful exploitation allows execution of arbitrary code.

NOTE: This vulnerability is currently being actively exploited.

2) An error when processing JavaScript calls to the "getIcon()" method of a "Collab" object can be exploited to cause a stack-based buffer overflow via a specially crafted argument.

NOTE: This is already fixed in Adobe Acrobat/Reader 8.1.3.

3) A boundary error in the processing of JBIG2 streams can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file containing a malformed JBIG2 symbol dictionary segment.

4) A boundary error in the processing of JBIG2 streams can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file.

5) A boundary error in the processing of JBIG2 streams while initialising memory can be exploited to trigger a memory corruption via a specially crafted PDF file.

6) An unspecified input validation error in the processing of JBIG2 streams can be exploited to potentially execute arbitrary code.

Solution
Adobe Reader 9:
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Reported as a 0-day.
2) Tenable Network Security, reported via ZDI.
3) Alin Rad Pop, Secunia Research
4) Sean Larsson, iDefense Labs
5) Jonathan Brossard from iViZ Security Research Team
6) The vendor credits Will Dormann of CERT/CC.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Adobe:
http://www.adobe.com/support/security/advisories/apsa09-01.html
http://www.adobe.com/support/security/bulletins/apsb09-03.html
http://www.adobe.com/support/security/bulletins/apsb09-04.html

Secunia Research:
http://secunia.com/secunia_research/2009-14/

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-09-014/

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=776

iViZ Security Research:
http://www.ivizsecurity.com/security-advisory-iviz-sr-09001.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers