CVE-2018-14294

CVE-2018-14294 affects Foxit Reader; vulnerable component is the processing of FileAttachment annotations. An attacker can craft a document to trigger a use-after-free, enabling remote code execution in the current process after user opens a malicious file or visits a malicious page. Impact is re...

CVE-2018-14283

CVE-2018-14283 affects Foxit Reader (Windows) versions older than 9.2.0.9097. The flaw is in the highlightMode attribute and stems from not validating the existence of an object before performing operations on it, leading to a use-after-free condition that enables remote code execution under the ...

CVE-2018-14305

CVE-2018-14305 affects Foxit Reader (notably 9.0.1.5096) and allows remote code execution via manipulation of PolyLine annotations during document processing. The flaw is a use-after-free in the annotation handling, exploitable when a user opens a malicious file or visits a malicious page, with u...

CVE-2018-14316

Foxit Reader vulnerability CVE-2018-14316 affects Foxit Reader 9.0.1.5096 where PDF processing lacks proper validation, causing a read past the end of an allocated buffer. This enables remote code execution in the context of the current process and requires user interaction (visiting a malicious ...

CVE-2018-14284

Foxit Reader CVE-2018-14284 affects Foxit Reader 9.0.1.1049 and is rooted in the newDoc function: the code fails to verify the existence of an object before operating on it, enabling remote code execution with user interaction. The vulnerability has been discussed in multiple advisories (ZDI-18-7...

CVE-2018-11619

CVE-2018-11619 affects Foxit Reader. The vulnerability lies in the handling of the setFocus method where an object’s existence is not validated before operations, enabling a remote attacker to execute arbitrary code in the context of the current process. Exploitation requires user interaction (vi...

CVE-2018-14303

Overview: CVE-2018-14303 affects Foxit Reader 9.0.1.5096 and Foxit PhantomPDF pre-9.2.0.9097. The flaw exists in StrikeOut annotation handling and is a use-after-free vulnerability that can allow remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a...

CVE-2018-14275

Foxit Reader CVE-2018-14275: A type confusion in spawnPageFromTemplate in Foxit Reader (affecting versions including 9.0.1.1049) allows remote code execution when a user visits a malicious page or opens a malicious file; exploitation requires user interaction and can execute code in the current p...

CVE-2018-14281

Foxit Reader vulnerability CVE-2018-14281 involves the exportData XFA function where improper validation of user-supplied data allows writing arbitrary files, enabling remote code execution under the process context. The issue requires user interaction (visiting a malicious page or opening a mali...

CVE-2018-14254

CVE-2018-14254 affects Foxit Reader (notably 9.0.1.1049) where a type confusion in the getLinks method can be triggered by JavaScript on a malicious page or file, allowing remote code execution under the process context. Multiple connected sources corroborate a getLinks-based type confusion with ...

CVE-2018-14256

CVE-2018-14256 affects Foxit Reader, where the flaw is in the getOCGs method leading to a type confusion and remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a crafted file). Affected: Foxit Reader 9.0.1.1049 (and related Foxit products); multipl...

CVE-2018-14255

Foxit Reader 9.0.1.1049 is affected by a type confusion in getNthFieldName that enables remote code execution when a user opens a malicious page/file or interacts with JavaScript. The flaw allows code execution in the context of the current process and is associated with ZDI-6018. Mitigation per ...

CVE-2018-14282

CVE-2018-14282 affects Foxit Reader prior to 9.2.0.9097. The vulnerability is a FlateDecode stream handling issue caused by an uninitialized pointer, enabling remote code execution under the current process when a user opens a malicious file or visits a malicious page. Exploitation requires user ...

CVE-2018-14298

CVE-2018-14298 affects Foxit Reader up to 9.0.1.5096 (Windows). The flaw is a use-after-free in Ink annotations processing, allowing arbitrary code execution when a user opens a poisoned document or visits a malicious page. Root cause: pointer reuse after free during document element manipulation...

CVE-2018-14293

CVE-2018-14293 affects Foxit Reader 9.1.0.5096 and earlier, where parsing of PDF documents can trigger a use-after-free in the PDF handling code, allowing remote code execution when a user opens a malicious file or visits a malicious page. The vulnerability requires user interaction and executes ...

CVE-2018-14279

Foxit Reader CVE-2018-14279 is a remote code execution due to a type confusion in the resetForm method. Exploitation requires user interaction (visit a malicious page or open a malicious file). Affected product scope includes Foxit Reader (versions before the latest provided in advisories) and is...

CVE-2018-11618

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-11621

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-14291

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14290

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...