Adobe Systems said today that it would patch a critical Reader vulnerability on Thursday.
Two weeks ago, Adobe had promised to fix the flaw during the week of Aug. 16 with an emergency, or "out-of-band" security update, but had not slated a specific date. Computerworld had pegged the likely release date as Aug. 17 based on past Adobe practice of issuing many of its security updates on Tuesdays.
[ In "Google vs. Microsoft: The battle of Ormandy," InfoWorld's Neil McAllister explores how the security community is divided over what constitutes "reasonable" disclosure of security vulnerabilities. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]
The bug Adobe plans to patch was disclosed by researcher Charlie Miller at last month's Black Hat security conference, when he demonstrated how the open-source BitBlaze toolkit could be used to boost bug-hunting productivity.
Miller, an analyst with Baltimore-based Independent Security Evaluators, is well-known for finding vulnerabilities in Adobe's popular Reader PDF viewer. Last March, Miller showed how a simple fuzzing tool could root out scores of potential bugs in Reader and other software.
Miller said the vulnerability is in Reader's and Acrobat's font parsing, but is not connected with the PDF font parsing flaw exploited by hackers to "jailbreak" Apple's iOS 4 earlier this month. Apple patched the font vulnerability last Wednesday.
On Tuesday, Miller said that Adobe knew of the font bug in Reader and Acrobat before he revealed it at Black Hat.
"Apparently @taviso previously reported to Adobe the Reader 0-day I dropped at BH," Miller said on Twitter. "Haha, ruined his effort at trying to be responsible."