CVE-2018-9975

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9975 due to a shift-event handling flaw. The issue stems from not validating the existence of an object before performing operations, enabling a remote attacker to execute code in the context of the current process after user interaction (visiting a...

CVE-2018-9961

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9961. The vulnerability stems from the parsing of the Field rect attribute, due to not validating the existence of an object before performing operations, enabling remote code execution in the current process when a user opens a malicious file or vi...

CVE-2018-9984

CVE-2018-9984 affects Foxit Reader 9.0.0.29935. The vulnerability is in the parsing of Texture Image Channels objects inside U3D files, caused by insufficient validation of user-supplied data, which can lead to a read past the end of an allocated object and information disclosure. Exploitation re...

CVE-2018-9962

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-10476

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-9983

Foxit Reader 9.0.0.29935 is affected by an out-of-bounds read in the U3D parsing path. The issue stems from insufficient validation of user-supplied data, leading to potential disclosure of sensitive information. Exploitation requires user interaction (visiting a malicious page or opening a malic...

CVE-2018-9960

CVE-2018-9960 affects Foxit Reader 9.0.1.1049. The vulnerability stems from the parsing of the textColor Field attribute where the code fails to validate the existence of an object before performing operations, allowing remote code execution under the current process. Exploitation requires user i...

CVE-2018-9980

Foxit Reader 9.0.0.29935 is affected by a U3D parsing out-of-bounds read vulnerability that can disclose sensitive information. The flaw stems from insufficient validation of user-supplied data during U3D parsing, allowing remote attackers to read past the end of an allocated object. Exploitation...

CVE-2018-9944

CVE-2018-9944 affects Foxit Reader 9.0.0.29935. The vulnerability resides in the addLink method and stems from not validating the existence of an object before performing operations, enabling remote code execution under the current process context. Exploitation requires user interaction (visiting...

CVE-2018-9967

Foxit Reader 9.0.1.1049 is affected by a TextBox Format Use-After-Free/validation flaw that allows remote code execution when a user opens a malicious file or visits a crafted page. The issue stems from failing to validate the existence of a TextBox object before performing operations, enabling c...

CVE-2018-9939

Foxit Reader 9.0.0.29935 is affected by a Type Confusion in the XFA layout handling that could allow remote code execution. The flaw arises from improper validation of user-supplied data, enabling an attacker to run code in the current process context after the target views a malicious page or fi...

CVE-2018-9956

Foxit Reader 9.0.1.1049 is affected by a remote code execution vulnerability in the XFA Button handling. The flaw occurs when setting the title attribute; the code path does not validate the existence of an object before performing operations, enabling an attacker to execute code in the process c...

CVE-2018-9946

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9946 due to a setTimeOut handling flaw where code executes without validating the existence of an object before operations. This can disclose sensitive information; exploitation requires user interaction (visit a malicious page or open a malicious ...

CVE-2018-10488

CVE-2018-10488 affects Foxit Reader 9.0.0.29935. The issue is a heap-based buffer overflow in parsing U3D Texture Width structures caused by insufficient validation of user-supplied data, allowing remote code execution when a user visits a malicious page or opens a malicious file. Exploitation re...

CVE-2018-9973

CVE-2018-9973 affects Foxit Reader 9.0.1.1049. The flaw is an out-of-bounds read during ePub file parsing caused by insufficient validation of input data, which can lead to sensitive information disclosure and, in combination with other vulnerabilities, arbitrary code execution in the affected pr...

CVE-2018-9953

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9953. The vulnerability lies in the XFA resolveNodes method of Button elements, where code executes without validating the existence of an object before performing operations. This allows remote code execution with the current process context and re...

CVE-2018-9968

This entry documents a Foxit Reader 9.0.1.1049 remote code execution vulnerability (CVE-2018-9968). The flaw lies in TextBox keyboard input handling where an object’s existence isn’t validated before operations, enabling an attacker to execute code in the current process when a user visits a mali...

CVE-2018-9943

Foxit Reader 9.0.0.29935 is affected by a type-confusion vulnerability in the openList handling that enables remote code execution when a user visits a malicious page or opens a malicious file. Root cause: improper validation of user-supplied data leading to type confusion; attack context is the ...

CVE-2018-9963

Foxit Reader 9.0.1.1049 is affected by a JPEG2000 parsing flaw that allows an out-of-bounds read, enabling information disclosure and potentially code execution in the context of the current process. The vulnerability arises from inadequate validation of user-supplied data, resulting in a read pa...

CVE-2018-10479

Foxit Reader 9.0.0.29935 is affected by CVE-2018-10479 due to an out-of-bounds read in parsing U3D Key Frame structures, causing information disclosure. The vulnerability allows remote attackers to disclose sensitive information and requires user interaction (visiting a malicious page or opening ...