{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/139","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/139/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/139/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/139/events","html_url":"https://github.com/chrsmith/google-security-research/issues/139","id":58936947,"number":139,"title":"Adobe Reader X and XI for Windows out-of-bounds write in AGM.dll","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-9159","name":"CVE-2014-9159","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-mjurczyk","name":"Finder-mjurczyk","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2014-Dec-9","name":"Fixed-2014-Dec-9","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Id-3117","name":"Id-3117","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-Reader","name":"Product-Reader","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Oct-30","name":"Reported-2014-Oct-30","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Adobe","name":"Vendor-Adobe","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-25T17:16:24Z","updated_at":"2015-02-25T17:16:25Z","closed_at":"2015-02-25T17:16:24Z","body":"```\nThe following access violation was observed in Adobe Reader X and XI for \nWindows:\n\n(1230.15dc): Access violation - code c0000005 (first chance)\nFirst chance exceptions are reported before any exception handling.\nThis exception may be expected and handled.\neax=000000ff ebx=00000000 ecx=0c826b50 edx=0c6d0ffd esi=0c6d1000 edi=0017be70\neip=695c4d43 esp=0017bd78 ebp=00000001 iopl=0         nv up ei pl nz ac po nc\ncs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212\nAGM!AGMTerminate+0xf2dcd:\n695c4d43 8806            mov     byte ptr [esi],al          ds:0023:0c6d1000=??\n0:000> k\nChildEBP RetAddr  \nWARNING: Stack unwind information not available. Following frames may be wrong.\n0017bdec 73144306 AGM!AGMTerminate+0xf2dcd\n0017be44 69499a2c BIB!BIBInitialize4+0x50a\n0017be48 3b179425 AGM!AGMInitialize+0x2eeb1\n\nNotes:\n\n- Reproduces on Adobe Reader X (10.1.12) and Adobe Reader XI (11.0.09) for \nWindows, on Windows 7, with Application Verifier enabled.\n\n- The “ESI” register points into a heap boundary of a region of size \n0x5c000.\n\n- The crash occurs approximately at the first iteration of a loop, which should \nnormally iterate three times.\n\n- Based on the type of memory reference causing the crash, we can assume it is \na heap based buffer overflow.\n\n- Attached samples: signal_sigsegv_f6529e93_1074_172.pdf (crashing file), \n172.pdf (original file).\n\nThis bug is subject to a 90 day disclosure deadline. If 90 days elapse without \na broadly available patch, then the bug report will automatically become \nvisible to the public.\n\n```\n\n-----\nOriginal issue reported on code.google.com by `mjurc...@google.com` on 30 Oct 2014 at 1:02\n\nAttachments:\n* [signal_sigsegv_f6529e93_1074_172.zip](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-139/comment-0/signal_sigsegv_f6529e93_1074_172.zip)\n* [172.zip](https://storage.googleapis.com/google-code-attachments/google-security-research/issue-139/comment-0/172.zip)\n"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76006876","html_url":"https://github.com/chrsmith/google-security-research/issues/139#issuecomment-76006876","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/139","id":76006876,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:16:25Z","updated_at":"2015-02-25T17:16:25Z","body":"```\nhttp://helpx.adobe.com/security/products/reader/apsb14-28.html\n```\n\n-----\nOriginal comment by `mjurc...@google.com` on 10 Dec 2014 at 1:03\n* Changed state: **Fixed**\n* Added labels: **CVE-2014-9159**, **Fixed-2014-Dec-9**\n* Removed labels: **Restrict-View-Commit**"}}