CVE-2017-14821

CVE-2017-14821 affects Foxit Reader 8.3.1.21155, with the root cause in parsing the xTsiz member of SIZ markers, leading to potential information disclosure and, in conjunction with other vulnerabilities, code execution. The exploit requires user interaction (visiting a malicious page or opening ...

CVE-2017-14823

CVE-2017-14823 affects Foxit Reader 8.3.1.21155. The flaw is in the signer method of XFA’s Signature objects, caused by inadequate validation, leading to a type confusion that enables remote code execution in the context of the current process. Exploitation requires user interaction (visiting a m...

CVE-2017-14824

CVE-2017-14824 affects Foxit Reader 8.3.1.21155 (XFAScriptObject insert) where improper validation of user-supplied data can cause a type confusion, enabling remote code execution. The vulnerability requires user interaction (malicious page or file) and allows code execution with the current proc...

CVE-2017-14825

CVE-2017-14825 affects Foxit Reader; vulnerability is a type confusion in XFAScriptObject.remove, enabling remote code execution. Affected: Foxit Reader 8.3.1.21155 with user interaction required (malicious page/file). Documented exploitation exists (malware in the wild per OpenVAS/OpenVAS notes)...

CVE-2017-14827

CVE-2017-14827 affects Foxit Reader 8.3.1.21155 where the append method of XFA Node objects fails to properly validate user-supplied data, causing a type-confusion vulnerability that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a mali...

CVE-2017-14828

CVE-2017-14828 affects Foxit Reader 8.3.1.21155 where a type-confusion in the XFA Layout w method allows remote code execution. Exploitation requires user interaction (malicious page or file). Root cause: improper validation of user-supplied data. Impact: arbitrary code execution in the current p...

CVE-2017-14829

CVE-2017-14829 affects Foxit Reader 8.3.1.21155. The flaw is in XFAScriptObject.openList, caused by improper validation of user-supplied data, leading to a type confusion condition that allows remote code execution in the current process when a user opens a malicious page or file. Exploitation re...

CVE-2017-14830

CVE-2017-14830 affects Foxit Reader 8.3.1.21155. The flaw is in the XFAScriptObject.setFocus method, caused by improper validation of user-supplied data, leading to a type confusion condition and remote code execution when a user visits a malicious page or opens a malicious file. Exploitation det...

CVE-2017-14831

CVE-2017-14831 affects Foxit Reader 8.3.1.21155. The root cause is the author attribute of Circle Annotation objects: the implementation does not validate the existence of an object before operating on it, enabling remote code execution in the context of the current process when a user opens a ma...

CVE-2017-14833

CVE-2017-14833 affects Foxit Reader 8.3.1.21155 and related builds, where the style attribute of Text Annotation objects can be manipulated after object existence is not validated, enabling remote code execution in the current process. Exploitation requires user interaction (visiting a malicious ...

CVE-2017-14837

CVE-2017-14837 affects Foxit Reader 8.3.1.21155, with a remote code execution flaw in the XFA Layout objects pageSpan method caused by improper validation of user-supplied data, enabling code execution with user interaction (via a malicious page or file). Multiple corroborating sources classify t...

CVE-2017-16571

CVE-2017-16571 affects Foxit Reader 8.3.1.21155. The issue is a type-confusion flaw in handling references to the app object from FormCalc, enabling remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The vulnerability is document...

CVE-2017-16574

Summary (CVE-2017-16574): Foxit Reader (8.3.1.21155) is affected by an information-disclosure vulnerability in the Image filters parsing, caused by inadequate validation of user-supplied data, which can lead to an out-of-bounds read. Exploitation requires user interaction (visiting a malicious pa...

CVE-2017-16575

CVE-2017-16575 affects Foxit Reader and is a remote code execution vulnerability in the XFA bind element. The root cause is a failure to validate the existence of an object before performing operations on it, enabling an attacker to execute arbitrary code in the current process when a user opens ...

CVE-2017-16576

CVE-2017-16576 affects Foxit Reader, notably versions around 8.3.1.21155 (and related 8.3.x lines). The root cause is in the XFA field element where the code fails to validate object existence before operating on it, enabling remote code execution when a user opens a malicious page or file and in...

CVE-2017-16578

The CVE-2017-16578 entry concerns Foxit Reader 8.3.2.25013 and describes a type confusion in the XFA forms’ picture elements that allows remote code execution after user interaction (visiting a malicious page or opening a malicious file). The underlying issue is improper validation of user-suppli...

CVE-2017-16579

CVE-2017-16579 affects Foxit Reader 8.3.2.25013 (and related Foxit products). The vulnerability arises in the JPEG2000 image parsing path due to insufficient validation of user-supplied data, allowing an out-of-bounds read past the end of an allocated object. This can lead to information disclosu...

CVE-2017-16580

CVE-2017-16580 affects Foxit Reader 8.3.2.25013 where the ImageField node in XFA forms mishandles user-supplied data, causing an out-of-bounds/read past end vulnerability. The issue enables remote information disclosure and can be leveraged in conjunction with other flaws to execute code in the p...

CVE-2017-16581

Foxit Reader 8.3.2.25013 is affected by CVE-2017-16581. The vulnerability is a remote code execution flaw in the author attribute of the Document object due to not validating the existence of an object before performing operations. Exploitation requires user interaction (visiting a malicious page...

CVE-2017-16584

Foxit Reader 8.3.2.25013 contains a vulnerability in util.printf that allows read past the end of an allocated object, enabling information disclosure. Exploitation requires user interaction (e.g., visiting a malicious page or opening a malicious file) and can be combined with other flaws to exec...