Security issue.

Nov 20, 2025 Last reply: 8 months ago 19 Replies

My accountant has mailed me a document to fill in for tax return purposes.



Firefox whinges about active content in the attachment and refuses to touch it!



Any suggestions?



It probably has active forms, that maybe eg check some of the data fields.

I wouldn't fill it in with Firefox, instead open it in Adobe Reader.

(other PDF readers may work, but I'd stick with Adobe as others may not do the forms correctly)

Theo

OK Theo. I'll give that a try. Thanks

No go. I tried Adobe reader 9

Tim

It has now opened in *open office writer* after lots of imprecations!

Tim

Sorry - not clear exactly about what you have been emailed. Are you saying you were emailed a *.pdf and you tried to open it in Firefox? I don't have Fx set as my default pdf reader; were you using webmail (and so already in Fx) when you tried to open the pdf?

And you've downloaded and saved it and now tried to open it in Adobe Reader 9, but that didn't work. Have you tried a newer version of Acrobat? Version 9 is now 12 years old, and might not like trying to deal with something in a form created very recently.

Some, but not all of the file, can be read in Notepad.

%PDF-1.7 <=== if a high version, the old reader won't open it

4 0 obj (Identity) endobj 5 0 obj (Adobe) endobj 8 0 obj

There are some higher tech versions which are digitally signed and encrypted, which will cause Notepad to have a heart attack.

Sometimes the file extension hints at what it is (PDF versus FDF). This one is fill-able but Linux does not recognize the sub-type.

$ file t5013sch1-fill-24e.pdf

t5013sch1-fill-24e.pdf: PDF document, version 1.7

I used okular on it, in Windows 11 bash shell, and it says this about my document (downloaded from gov)

"This document has XFA forms, which are currently unsupported" # That's a Jetform doc

formatting link
[ ] okular-master-6952-windows-cl-msvc2022-x86_64-sideload.appx 2025-11-20 01:02 290M [ ] okular-master-6952-windows-cl-msvc2022-x86_64.7z 2025-11-20 00:54 150M [ ] okular-master-6952-windows-cl-msvc2022-x86_64.7z.sha256 2025-11-20 00:54 66 [ ] okular-master-6952-windows-cl-msvc2022-x86_64.appxupload 2025-11-20 00:58 327M [ ] okular-master-6952-windows-cl-msvc2022-x86_64.exe 2025-11-20 00:56 151M <=== win32 version [ ] okular-master-6952-windows-cl-msvc2022-x86_64.exe.sha256 2025-11-20 00:56 66

The one I have is slightly older.

Name: okular-23.08.4-1666-windows-cl-msvc2019-x86_64.exe Size: 131284112 bytes (125 MiB) SHA256: 8BE0D92CFBE9B1B8A2A9B83D3C1FFC5A94E07CEC901D59118D8D1CBB23923A98

While that tool (like most), may not handle the file type, it may be able to tell you what sub-type it is.

And XFA is a former Jetform product, and Jetform was bought by Adobe, Adobe moved into the building, got bored and eventually left town.

formatting link
So that's a rough idea how I might do forensics without going crazy.

My regular tools won't do the recognition, and I hate the current Adobe freebie, to have not only removed it from the computer, it is never to be installed on the computer again :-/ I wrote them some feedback when removing the tool, as if that will make a difference. This puts us between a rock and a hard place, to have a miserable piece of bloatware as "the only game in town".

formatting link
# "trusted", my ass

Good luck, Paul

OK Now Jeff. Basically a tax return form with boxes to enter data.

Open office did the job once I had ignored all the warnings.

Tim

>

Snip.

OK Paul. Open office grudgingly agreed it could be opened once I had deleted the warning messages.

Tim

It sounds like a Word document with enbedded macros. It might either have been written with an old version of Word or the developer might not have added their digital signature.

Having filled in the data, I saved it so I could attach it to the return. No luck. The new data was excluded from the saved version. As a work round, I scanned the printed version and sent that back. I'll bet the next problem will arise when I am asked to sign the final submission for the Inland Revenue!

Did you try to just "Save"? If so, and it was a read-only document, try "Save as" using a different name. If that works, you should be able to attach that file with the new name to the return.

What you're doing is filling in a 'smart' form, which has various boxes to enter the data but they turn into fields in a database, not just printable text. By entering it in OpenOffice you've broken the 'smart' side of things, which:

a) means the data in the form isn't machine readable in a way that's amenable to automated processing of your return

b) bypassed all the checks on the fields embedded in the form (eg 'this box must contain a number of whole pounds without a pound sign or decimal point')

c) is saved in a different data structure to the printable content of the form

You need to use Adobe Reader for these and a 12 year old version won't cut it. Install a modern version and try that:

formatting link
Theo

Yeah, PDF form-filling is the one thing I use the Adobe Reader for ...

Bzzt! Fail. Adobe is the technical term for "Security risk".

Which other software is able to cope with filling in PDF forms? Including all the machine readable data formatting and Javascript stuff they do? [just writing text in the boxes is not sufficient]

Theo

I have never had any issues with Foxit but don't do many forms

Dave

It would be helpful for us, if you could gather some sort of identification from it, mainly so we can pass this information along to the next "victim".

PDFs can contain innumerable things, like you can play a movie in a PDF, and you can have programmable content in there too. If the AV programs know all the details about the format, how it could attack the machine, they're keeping quiet about it.

It is possible to make a PDF as a dual representation. The PDF can have the usual Portable Document Format material (which is covered by an ISO standard), but it can also contain a copy of an MSWord document which is supposed to be the document that made the PDF. And Microsoft Office can open those (as if they were Word). I don't know if that is what happened in your case or not.

Paul

I've not heard of any third party program that works without issue. By not being standardized, the XFA Jetform subtype, can act as a wedge to keep Adobe in business.

There is a kind of PDF, where an MSWord document is embedded inside it as a dual-representation. I'm not aware of any such beast being mentioned in public (by end users). And I don't know if programs can recognize such a thing or not (like whether LibreOffice says anything if it is fed such a document).

Paul

I had a pension transfer form to sign today. I used Brave browser running on Linux.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required