CVE-2021-34965 Foxit PDF Editor Squiggly Annotation Use-After-Free Remote Code Execution Vulnerability

🗓️ 07 May 2024 22:54:38Reported by zdiType

Foxit PDF Editor Squiggly Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

Reporter	Title	Published	Views	Family All 17
attackerkb	CVE-2021-34965	7 May 202423:15	–	attackerkb
BDU FSTEC	Foxit PhantomPDF Buffer Overflow	17 Dec 202100:00	–	bdu_fstec
CNNVD	Foxit PDF Editor 缓冲区错误漏洞	15 Oct 202100:00	–	cnnvd
CVE	CVE-2021-34965	7 May 202422:54	–	cve
EUVD	EUVD-2021-21612	7 Oct 202500:30	–	euvd
Tenable Nessus	Foxit PDF Editor < 11.1 Multiple Vulnerabilities	12 Oct 202100:00	–	nessus
Tenable Nessus	Foxit PhantomPDF < 10.1.6 Multiple Vulnerabilities	29 Nov 202100:00	–	nessus
Tenable Nessus	Foxit PDF Reader < 11.1 Multiple Vulnerabilities	12 Oct 202100:00	–	nessus
Kaspersky	KLA12317 Multiple vulnerabilities in Foxit Reader	12 Oct 202100:00	–	kaspersky
NVD	CVE-2021-34965	7 May 202423:15	–	nvd

[
  {
    "vendor": "Foxit",
    "product": "PDF Editor",
    "versions": [
      {
        "version": "11.0.0.49893",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
foxit	www.foxit.com/support/security-bulletins.html
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-21-1196/

07 May 2024 22:54Current

8.2High risk

Vulners AI Score8.2

CVSS 37.8

EPSS0.00349

SSVC

CWE-416