3 ms·

Just the text, for those of you unwilling to open PDFs from security researchers: http://pastebin.com/rG3RD6hw http://pastebin.com/rG3RD6hw

• joshka 10y ago
  A pdf probably isn't going to be able to run JavaScript in your browser (the primary mechanism that this attack utilizes. Pastebin on the other hand... ;)
  • nmjohn 10y ago
    No, but depending on what program you open it with it may be able to do far worse than execute javascript in a browser sandbox. [0][1] [0]: https://blog.didierstevens.com/2010/03/29/escape-from-pdf/ https://blog.didierstevens.com/2010/03/29/escape-from-pdf/ [1]: https://thestack.com/security/2016/06/09/pdf-exploit-found-in-default-google-chrome-reader/ https://thestack.com/security/2016/06/09/pdf-exploit-found-i...
  • pests 10y ago
    Except some major browsers like Chrome do their entire PDF rendering in JavaScript.
    • JonathonW 10y ago
      Chrome's PDF renderer is a PPAPI plugin written in C++. Firefox is the one with the Javascript-based PDF renderer.
      • pjmlp 10y ago
        > Firefox is the one with the Javascript-based PDF renderer. And it shows, hence why I always disable it.
      • pests 10y ago
        Oops yes you are correct. My original point still applies though.
  • joshka 10y ago
    In case the ;) did not make it obvious, this comment was meant to be taken as sarcasm.