CVE-2018-9971

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.104. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-10486

Foxit Reader 9.0.0.29935 is affected by an out-of-bounds read in the U3D Image Index parsing, allowing remote disclosure of sensitive information. The issue arises from improper validation of user-supplied data and requires user interaction (visiting a malicious page or opening a malicious file)....

CVE-2018-10476

Foxit Reader 9.0.0.29935 is affected by an information-disclosure vulnerability in the U3D Model Node parsing. The issue stems from improper validation of user-supplied data, causing a read past the end of an allocated structure (out-of-bounds read). An attacker can leverage this by convincing a ...

CVE-2018-10493

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-9948

The provided connected documents confirm CVE-2018-9948 affects Foxit Reader (notably v9.0.x), describing a Use-After-Free flaw in the Text Annotations component and in TypedArray handling due to uninitialized pointers. Exploitation requires a crafted PDF/file and can lead to remote code execution...

CVE-2018-9960

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9955

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA...

CVE-2018-9956

Foxit Reader 9.0.1.1049 is affected by a remote code execution vulnerability in the XFA Button handling. The flaw occurs when setting the title attribute; the code path does not validate the existence of an object before performing operations, enabling an attacker to execute code in the process c...

CVE-2018-9951

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9951, a CPDF_Object handling flaw that lacks validation of object existence, enabling remote code execution under the current process context. Exploit requires user interaction (visiting a malicious page or opening a malicious file). The issue is d...

CVE-2018-9949

CVE-2018-9949 affects Foxit Reader 9.0.0.29935. The issue is a TIFF parsing heap-based buffer overflow caused by insufficient validation of user-supplied data length, allowing remote code execution with the current process context. Exploitation requires user interaction (visiting a malicious page...

CVE-2018-9953

Foxit Reader 9.0.1.1049 is affected by CVE-2018-9953. The vulnerability lies in the XFA resolveNodes method of Button elements, where code executes without validating the existence of an object before performing operations. This allows remote code execution with the current process context and re...

CVE-2018-9952

The CVE-2018-9952 vulnerability affects Foxit Reader 9.0.1.1049 and is due to improper validation when handling XFA Button elements, specifically when setting the formattedValue attribute, allowing an attacker to execute code under the current process. Exploitation requires user interaction (visi...

CVE-2018-9947

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9947, a heap-based buffer overflow in BMP image parsing. The flaw arises from improper validation of the length of user-supplied data before copying to a fixed-length heap buffer, allowing remote code execution. Exploitation requires user interacti...

CVE-2018-9946

Foxit Reader 9.0.0.29935 is affected by CVE-2018-9946 due to a setTimeOut handling flaw where code executes without validating the existence of an object before operations. This can disclose sensitive information; exploitation requires user interaction (visit a malicious page or open a malicious ...

CVE-2018-9935

Foxit Reader 8.3.2.25013 is affected by a remote code execution vulnerability in the addField method. The root cause is failing to validate the existence of an object before operating on it, leading to potential code execution under the current process context. Public sources (ZDI-18-319) describ...

CVE-2018-9942

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9942

The CVE-2018-9942 entry concerns Foxit Reader (v9.0.0.29935) and the XFA record removal path. The connected sources confirm a type-confusion vulnerability that enables remote code execution in the context of the current process. Exploitation requires user interaction (visiting a malicious page or...

CVE-2018-9945

Foxit Reader 9.0.0.29935 is affected by a getField use-after-free/validation flaw that allows remote code execution when a user opens a malicious file or visits a malicious page. The root cause is failure to validate the existence of an object before operating on it, enabling arbitrary code execu...

CVE-2018-9940

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-9969

CVE-2018-9969 affects Foxit Reader (v9.0.1.1049) and is due to a flaw in the XFA boundItem method of Button elements. The vulnerability arises from not validating the existence of an object before performing operations, enabling remote code execution under the process context when a user opens a ...