Lucene search

[email protected]CVE-2018-18689

HistoryJan 07, 2021 - 6:15 p.m.

CVE-2018-18689

2021-01-0718:15:12

CWE-347

[email protected]

web.nvd.nist.gov

cve-2018-18689

portable document format

pdf

signature wrapping

foxit reader

phantompdf

expert pdf

nitro pro

nitro reader

pdf architect

pdf editor

pdf experte

pdfelement

pdf studio

pdf-xchange editor

perfect pdf

soda pdf

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

54.7%

JSON

The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.

Affected configurations

NVD

Node

microsoftwindowsMatch-

AND

avanquestexpert_pdf_ultimateMatch12.0.20

avanquestpdf_experte_ultimateMatch9.0.270

foxitsoftwarefoxit_readerMatch9.1.0

foxitsoftwarefoxit_readerMatch9.2.0.9297

foxitsoftwarefoxit_readerMatch9.3.0.10826

gonitronitro_proMatch11.0.3.173

gonitronitro_readerMatch5.5.9.2

iskysoftpdf_editor_6Match6.4.2.3521professional

iskysoftpdfelement6Match6.8.0.3523professional

iskysoftpdfelement6Match6.8.4.3921professional

pdfforgepdf_architectMatch6.0.37

pdfforgepdf_architectMatch6.1.24.1862

qoppapdf_studioMatch12.0.7professional

qoppapdf_studio_viewer_2018Match2018.0.1

qoppapdf_studio_viewer_2018Match2018.2.0

sodapdfsoda_pdfMatch9.3.17

sodapdfsoda_pdf_desktopMatch10.2.09

sodapdfsoda_pdf_desktopMatch10.2.16.1217

soft-xpansionperfect_pdf_10Match10.0.0.1premium

soft-xpansionperfect_pdf_readerMatch13.0.3

soft-xpansionperfect_pdf_readerMatch13.1.5

tracker-softwarepdf-xchange_editorMatch7.0.237.1

tracker-softwarepdf-xchange_editorMatch7.0.326

tracker-softwarepdf-xchange_viewerMatch2.5

visagesoftexpert_pdf_readerMatch9.0.180

Node

applemacosMatch-

AND

foxitsoftwarefoxit_readerMatch9.1.0

foxitsoftwarefoxit_readerMatch9.2.0

iskysoftpdf_editor_6Match6.6.2.3315professional

iskysoftpdf_editor_6Match6.7.6.3399professional

iskysoftpdfelement6Match6.7.1.3355professional

iskysoftpdfelement6Match6.7.6.3399professional

qoppapdf_studioMatch12.0.7professional

qoppapdf_studio_viewer_2018Match2018.0.1

qoppapdf_studio_viewer_2018Match2018.2.0

Node

linuxlinux_kernelMatch-

AND

foxitsoftwarefoxit_readerMatch9.1.0

foxitsoftwarefoxit_readerMatch9.2.0

qoppapdf_studioMatch12.0.7professional

qoppapdf_studio_viewer_2018Match2018.0.1

qoppapdf_studio_viewer_2018Match2018.2.0

CPENameOperatorVersion
avanquest:expert_pdf_ultimateavanquest expert pdf ultimateeq12.0.20
avanquest:pdf_experte_ultimateavanquest pdf experte ultimateeq9.0.270
foxitsoftware:foxit_readerfoxitsoftware foxit readereq9.1.0
foxitsoftware:foxit_readerfoxitsoftware foxit readereq9.2.0.9297
foxitsoftware:foxit_readerfoxitsoftware foxit readereq9.3.0.10826
gonitro:nitro_progonitro nitro proeq11.0.3.173
gonitro:nitro_readergonitro nitro readereq5.5.9.2
iskysoft:pdf_editor_6iskysoft pdf editor 6eq6.4.2.3521
iskysoft:pdfelement6iskysoft pdfelement6eq6.8.0.3523
iskysoft:pdfelement6iskysoft pdfelement6eq6.8.4.3921

CPE	Name	Operator	Version
avanquest:expert_pdf_ultimate	avanquest expert pdf ultimate	eq	12.0.20
avanquest:pdf_experte_ultimate	avanquest pdf experte ultimate	eq	9.0.270
foxitsoftware:foxit_reader	foxitsoftware foxit reader	eq	9.1.0
foxitsoftware:foxit_reader	foxitsoftware foxit reader	eq	9.2.0.9297
foxitsoftware:foxit_reader	foxitsoftware foxit reader	eq	9.3.0.10826
gonitro:nitro_pro	gonitro nitro pro	eq	11.0.3.173
gonitro:nitro_reader	gonitro nitro reader	eq	5.5.9.2
iskysoft:pdf_editor_6	iskysoft pdf editor 6	eq	6.4.2.3521
iskysoft:pdfelement6	iskysoft pdfelement6	eq	6.8.0.3523
iskysoft:pdfelement6	iskysoft pdfelement6	eq	6.8.4.3921

Rows per page:

1-10 of 251

References

pdf-insecurity.org/signature/evaluation_2018.html

pdf-insecurity.org/signature/signature.html

www.foxitsoftware.com/support/security-bulletins.php

www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

54.7%

JSON

Related for CVE-2018-18689

nvd1 prion1 cvelist1 kaspersky1 nessus3 openvas2