CVE-2018-11620

CVE-2018-11620 affects Foxit Reader (up to version 9.0.1.1049) with an out-of-bounds read in ConvertToPDF_x86.dll caused by insufficient validation of user-supplied data. This can disclose sensitive information and, in conjunction with other vulnerabilities, may enable arbitrary code execution in...

CVE-2018-14253

The CVE-2018-14253 entry concerns Foxit Reader (variants of Foxit Reader 9.0.1.1049 and affected 9.x lines). The vulnerability is a type-confusion in the getIcon method that enables remote code execution. Exploitation requires user interaction (visiting a malicious page or opening a malicious fil...

CVE-2018-11622

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-14283

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14247

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14298

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14251

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14285

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2018-14260

Foxit Reader CVE-2018-14260 is a type-confusion remote code execution in getPageRotation that affects Foxit Reader 9.0.1.1049. Exploitation requires user interaction (visiting a malicious page or opening a malicious file). The flaw lets an attacker execute code in the current process context via ...

CVE-2018-11617

CVE-2018-11617 affects Foxit Reader (9.0.0.29935 and earlier) via a use-after-free in the handling of Format events for ComboBox fields. The root cause is failure to validate the existence of an object before performing operations on it, allowing remote attackers to execute arbitrary code with th...

CVE-2018-14267

Foxit Reader (Windows) is affected by CVE-2018-14267, a type-confusion vulnerability in the importTextData method that can be triggered to execute code remotely. Exploitation requires user interaction (visiting a malicious page or opening a crafted file) and results in arbitrary code execution in...

CVE-2018-14266

CVE-2018-14266 affects Foxit Reader (notably 9.0.1.1049 and earlier) and is caused by a flaw in the importDataObject method that leads to a type confusion. An attacker can trigger this remotely by convincing a user to visit a malicious page or open a malicious file, initiating remote code executi...

CVE-2018-14247

Foxit Reader CVE-2018-14247 is a type-confusion remote code execution vulnerability in the exportAsFDF method. Exploitation requires user interaction (visiting a malicious page or opening a malicious file via JavaScript) and can execute code under the current process. Connected advisories (e.g., ...

CVE-2018-14252

Foxit Reader 9.0.1.1049 is affected by CVE-2018-14252 due to a type confusion in getField. Exploitation requires user interaction (visiting a malicious page or opening a malicious file) and can lead to remote arbitrary code execution in the current process. Connected advisories (ZDI-18-712, CNVD-...

CVE-2018-14301

Foxit Reader is affected by a Sound annotations use-after-free remote code execution vulnerability (CVE-2018-14301). Exploitation requires user interaction (visiting a malicious page or opening a crafted file) and can lead to arbitrary code execution in the context of the current process. The fla...

CVE-2018-14272

CVE-2018-14272 affects Foxit Reader; a type confusion vulnerability in the removeIcon method can lead to remote code execution. The primary advisory notes that an attacker can exploit this by convincing a user to view a malicious page or open a malicious file, executing code in the current proces...

CVE-2018-14263

Foxit Reader (and Foxit PhantomPDF) are affected by a getVersionID type-confusion vulnerability that allows remote code execution when a user visits a malicious page or opens a malicious file. The flaw is triggered by JavaScript actions and runs with the current process context; exploitation requ...

CVE-2018-14291

Foxit Reader CVE-2018-14291 is a PDF parsing vulnerability (use-after-free) that allows remote code execution when an attacker manipulates PDF elements; user interaction (open a malicious file/page) is required. The weakness is in the parsing of PDF documents, specifically a pointer reuse after f...

CVE-2018-14306

CVE-2018-14306 affects Foxit Reader (and Foxit PhantomPDF) prior to 9.2.0.9097. A use-after-free in the handling/processing of button objects (pointer reuse after free) can be triggered when a user visits a malicious page or opens a malicious file, allowing remote code execution under the process...

CVE-2018-14315

CVE-2018-14315 affects Foxit Reader versions older than 9.2.0.9097, where the vulnerability lies in how annotations are handled. The flaw is due to not validating the existence of an object before performing operations, enabling remote code execution in the context of the current process when a u...