CVE-2009-0191

2009-03-1020:30:06

CWE-94

[email protected]

web.nvd.nist.gov

foxit reader

jbig2

vulnerability

pdf

code execution

cve-2009-0191

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

Low

0.089 Low

EPSS

Percentile

94.6%

JSON

Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 3.0.2009.1301, does not properly handle a JBIG2 symbol dictionary segment with zero new symbols, which allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a dereference of an uninitialized memory location.

Affected configurations

NVD

Node

foxitsoftwarefoxit_readerMatch2.3

foxitsoftwarefoxit_readerMatch3.0

foxitsoftwarefoxit_readerMatch3.0.2009.1301

CPENameOperatorVersion
foxitsoftware:foxit_readerfoxitsoftware foxit readereq2.3
foxitsoftware:foxit_readerfoxitsoftware foxit readereq3.0
foxitsoftware:foxit_readerfoxitsoftware foxit readereq3.0.2009.1301

CPE	Name	Operator	Version
foxitsoftware:foxit_reader	foxitsoftware foxit reader	eq	2.3
foxitsoftware:foxit_reader	foxitsoftware foxit reader	eq	3.0
foxitsoftware:foxit_reader	foxitsoftware foxit reader	eq	3.0.2009.1301