Looks like version 7.0.9 for Acrobat has been released today to address the PDF XSS flaw discussed last December and widely reported on January 3rd:

Adobe has provided an update to resolve a vulnerability in Adobe Reader and Acrobat. For more information, please refer to the APSB07-01 Security Bulletin. This cross-site scripting (XSS) vulnerability in versions 7.0.8 and earlier of Adobe Reader and Acrobat could allow remote attackers to inject arbitrary JavaScript into a browser session.

Bad stuff if you use a browser and view PDFs…which is basically (almost) everyone who “browses the web”. Recently the debate had moved on to how the flaw allows remote attackers to browse files on your local system…

You can also just upgrade to Acrobat 8.

eEye wants you to know that Microsoft has eight lingering zero day vulnerabilities, including one they say has been exposed for 420 days…

The following entries are active zero-day vulnerabilities. They have been publicly disclosed and/or used in attacks, and do not have any published vendor-supplied patch.

No vendor patch…but eEye will sell you some software that will “fix” things. The site is actually an advertisement for eEye products, so it’s interesting to see them alerting people to a low risk vuln that is over a year old, while still calling it “zero day”. Usually people talk about protecting you from tomorrow’s risks, rather than the ones you know of and probably aren’t planning to do anything about. On the other hand, maybe someone will find a way to increase damage or expand the risk of Microsoft’s memory exhaustion flaw.

Just a reminder from the Associated Press about the terror-able risks of flying:

“It felt like a shock, a tingly thing. Someone screamed, ‘It’s a scorpion,'” Sullivan recalled. Another passenger stepped on the two-inch arachnid. Someone suggested Sullivan seek medical help.

He scooped up the scorpion as a specimen and headed to the hospital in Burlington. Mrs. Sullivan stopped at the United counter and was told the plane they were on had flown from Houston to Chicago. The Sullivans surmised the scorpion boarded in Texas.

“The airlines tell you you can’t bring water or shampoo on a plane,” Mrs. Sullivan said, referring to recent security restrictions. “All the security we go through” apparently didn’t apply to the scorpion, she said.

Sneaky scorpions. The government should require them to carry identification.