CVE-2018-17637

Foxit Reader (Windows) vulnerable: Foxit Reader 9.2.0.9297 and earlier exposes a flaw in loadXML handling within the XFA object, where the code fails to validate the existence of an object before performing operations. This results in a use-after-free/memory misreference type condition that can a...

CVE-2018-17656

Foxit Reader (Windows) 9.2.0.9297 and Foxit PhantomPDF 9.2.0.9297 and earlier are affected by a vulnerability in the TimeField getDisplayItem handling that can allow remote code execution. The issue stems from not validating the existence of an object before performing operations, enabling an att...

CVE-2018-17659

CVE-2018-17659 affects Foxit Reader 9.2.0.9297 (and earlier Windows versions per CNVD entry). The flaw is in the Host object’s title handling, caused by failure to validate the existence of an object before performing operations, enabling remote code execution. Exploitation requires user interact...

CVE-2018-17650

CVE-2018-17650 affects Foxit Reader for Windows (version 9.2.0.9297 and earlier per CNVD/NVD references). The vulnerability stems from the TimeField.resolveNodes path where the code fails to validate the existence of an object before performing operations, enabling an attacker to execute arbitrar...

CVE-2018-17689

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17632

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17686

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-17699

The CVE-2018-17699 issue affects Foxit Reader 9.2.0.9297 and earlier on Windows, where the PDF processing path fails to validate user-supplied data, causing an out-of-bounds read (read past the end of an allocated buffer). This enables remote information disclosure and, when combined with other v...

CVE-2018-17645

The CVE-2018-17645 entry concerns Foxit Reader 9.2.0.9297 on Windows, where the vAlign handling of TimeField crashes when an object existence is not validated. This results in remote code execution in the context of the current process, with user interaction required (visiting a malicious page or...

CVE-2018-17688

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17626

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17685

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17661

CVE-2018-17661 affects Foxit Reader 9.2.0.9297 and earlier on Windows. The flaw is in the handling of the messageBox method of the Host object, stemming from not validating the existence of an object before performing operations, enabling remote code execution. Exploitation requires user interact...

CVE-2018-17679

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17634

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17676

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17697

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17653

The CVE-2018-17653 entry concerns Foxit Reader 9.2.0.9297 (and earlier) where the flaw is in the TimeField.resolveNode handling; the code fails to verify the existence of an object before performing operations, enabling remote code execution in the current process. Exploitation requires user inte...

CVE-2018-17666

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-17651

Foxit Reader 9.2.0.9297 contains a use-after-free/invalid object access flaw in the TimeField getItemState handler, where code executes without validating the existence of the object. This can allow remote code execution when a user opens a malicious file or visits a crafted page, as described by...