KLA10724 Code execution vulnerability in Foxit products

Multiple use-after-free vulnerabilities were found in Foxit products. By exploiting these vulnerabilities malicious users can execute arbitrary code. These vulnerabilities can be exploited remotely via a specially designed PDF document.

Technical details

Vulnerabilities related to Print method and App object handling.

Original advisories

Related products

Foxit-Reader

Foxit-Phantom-PDF

CVE list

CVE-2015-8580 high

Solution

Update to the latest version

Foxit software download page

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Affected Products

• Foxit Reader versions earlier than 7.2.2Foxit PhantomPDF versions earlier than 7.2.2