KLA10948 Denial of service and code execution vulnerability in Foxit Reader and Foxit PhantomPDF

Out-of bounds read vulnerability was found in the ConvertToPDF plugin in Foxit Reader and PhantomPDF. By exploiting this vulnerability malicious users can cause a denial of service, possibly obtain sensitive information or execute arbitrary code in the context of the current process. This vulnerability can be exploited remotely via a specially designed JPEG image.

Technical details

Vulnerability can be executed only if gflags app is enabled.

Original advisories

Foxit Security bulletins

Related products

Foxit-Reader

Foxit-Phantom-PDF

CVE list

CVE-2017-5556 high

Solution

Update to the latest versionsDownload Foxit Reader

Download Foxit PhantomPDF

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Foxit Reader before 8.2Foxit PhantomPDF before 8.2