The discovery of the flaw has caused considerable industry concern because of the ease with which it can be exploited and because any Web site hosting PDF files could be used to conduct an attack.

In an e-mailed comment, an Adobe spokesman said yesterday that the company is aware of a flaw in 7.0.8 and earlier versions of Adobe Reader and Acrobat that allows "remote attackers to inject arbitrary JavaScript into a browser session. This is not a vulnerability in PDF. Specifically, this issue could occur when a user clicks on a malicious link to a PDF on the Web."

The vulnerability, rated as "important'' by Adobe, cannot be exploited to "execute native code or erase hard drives" on a victim's PC, said Pam Deziel, director of the company's platform business unit. "There are some straightforward ways to mitigate this risk."

Upgrading to Adobe Reader 8 and Acrobat 8 "addresses the issue immediately" she said. "For Acrobat and Reader customers who wish to stay with their current version, they can use their browser preferences to disable the Reader plug-in from opening within the browser."

Adobe will soon publish additional details on the vulnerability, together with specifics on the affected browsers and mitigation measures, the spokesman said without offering details. The information will be available at www.adobe.com/support/security. The company will also release patches next week for fixing the flaws in the affected versions of Adobe Reader and Acrobat, the spokesman said.