CVE-2021-34965 Foxit PDF Editor Squiggly Annotation Use-After-Free Remote Code Execution Vulnerability

🗓️ 07 May 2024 22:54:38Reported by zdiType

Foxit PDF Editor Squiggly Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	The vulnerability of the PDF editing software Foxit PhantomPDF and the text viewing software Foxit Reader for Windows operating systems arises from allowing operations beyond the buffer boundaries in memory, enabling attackers to execute arbitrary code.	17 Dec 202100:00	–	bdu_fstec
CNNVD	Foxit PDF Editor 缓冲区错误漏洞	15 Oct 202100:00	–	cnnvd
CVE	CVE-2021-34965	7 May 202422:54	–	cve
EUVD	EUVD-2021-21612	7 Oct 202500:30	–	euvd
Tenable Nessus	Foxit PDF Editor < 11.1 Multiple Vulnerabilities	12 Oct 202100:00	–	nessus
Tenable Nessus	Foxit PhantomPDF < 10.1.6 Multiple Vulnerabilities	29 Nov 202100:00	–	nessus
Tenable Nessus	Foxit PDF Reader < 11.1 Multiple Vulnerabilities	12 Oct 202100:00	–	nessus
Kaspersky	KLA12317 Multiple vulnerabilities in Foxit Reader	12 Oct 202100:00	–	kaspersky
NVD	CVE-2021-34965	7 May 202423:15	–	nvd
OpenVAS	Foxit Reader Multiple Vulnerabilities (June-6 2024)	21 Jun 202400:00	–	openvas

[
  {
    "vendor": "Foxit",
    "product": "PDF Editor",
    "versions": [
      {
        "version": "11.0.0.49893",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-21-1196/
foxit	www.foxit.com/support/security-bulletins.html

07 May 2024 22:54Current

8.2High risk

Vulners AI Score8.2

CVSS 37.8

EPSS0.00349

CWE-416