KLA11398 Multiple vulnerabilities in Foxit Reader and Foxit PhantomPDF

Multiple vulnerabilities were found in Foxit Reader and Foxit PhantomPDF. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. Out-of-bounds Write/Read vulnerability can be exploited remotely to cause denial of service;
2. Validation Bypass vulnerability can be exploited remotely to obtain sensitive information.

Original advisories

CVE-2018-3956

CVE-2018-18688/CVE-2018-18689

ZDI-CAN-7347/ZDI-CAN-7452/ZDI-CAN-7601

ZDI-CAN-7353/ZDI-CAN-7423

ZDI-CAN-7368

ZDI-CAN-7369

ZDI-CAN-7453

ZDI-CAN-7576

ZDI-CAN-7355

Related products

Foxit-Reader

Foxit-Phantom-PDF

CVE list

CVE-2018-3956 high

CVE-2018-18688 warning

CVE-2018-18689 warning

Solution

Update to the latest versionDownload Foxit Reader

Download Foxit PhantomPDF

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Affected Products

• Foxit Reader 9.3.0.10826 and earlierFoxit PhantomPDF 9.3.0.10826 and earlier